EDPB: draft guidelines on anonymisation with AI in mind

The European Data Protection Board (EDPB) adopted a draft of new guidelines on the anonymisation of personal data (Guidelines 02/2026) – the first major update to the interpretation in over a decade, responding among other things to the capabilities of modern AI systems. Under the new framework, data is considered anonymous only if it passes three cumulative tests: no isolation of an individual's record, no linkage to other data, and no inference of information about a specific person. The guidelines explicitly warn that agentic AI and re-identification tools are lowering the cost and time needed to break anonymisation, and therefore advise against relying on an attacker's alleged "lack of motivation." Comments may be submitted until 30 October 2026.