Pseudonymisation of training data under the EDPB

You must now test any trained model for memorisation and extraction before claiming that training data is anonymous. Removing names or pseudonymising records is not enough. The European Data Protection Board requires that personal data cannot be singled out, linked to external sources or used for meaningful inference — and that test must run on the model itself, not only on the dataset.

The prompt is an analysis of 13 November 2026 of irreversible anonymisation and training data testing, which argues that anonymity claims about transformed training data must be assessed from the trained model, not only from the underlying dataset. The European Data Protection Board distinguishes sharply between pseudonymisation, where linkage to a person remains possible, and anonymisation, where it reasonably does not. The French CNIL and peer-reviewed research in the ACM Digital Library show that personal data can remain in model weights and be extracted via queries or other attacks. In our assessment, this creates a critical gap: an organisation that cleans the dataset but skips the model test bases an anonymity claim on an incomplete picture and leaves itself vulnerable to extraction investigation by a supervisory authority or researcher.

What does the EDPB's anonymisation test actually require?

The EDPB framework rests on three cumulative criteria. Data is anonymous only when records cannot be singled out, cannot be linked to external sources and cannot lead to meaningful inferences about a person. Because the criteria are cumulative, failure on any one of them means the data should not be treated as anonymous without further analysis. Importantly, this test is context-dependent: who can access the data, with what means and which additional datasets partly determine the outcome. That framework is separate from any other obligations that may apply under the EU AI Act, including data-governance requirements for high-risk systems.

Where does personal data hide in a trained model?

Information can end up in model weights during training and be reproduced later. The CNIL states that a model can only be considered anonymous when identification from the model parameters is highly unlikely and personal data cannot be extracted via model queries. The OECD notes that data can be memorised in model weights and that removing it from a trained model can require substantial technical effort and may not be straightforward. According to the ACM study and the CNIL analysis, a model-centric assessment should include privacy attacks such as memorisation and extraction, including query-based extraction.

Which concrete controls must you be able to demonstrate?

1. Record your threat model before use — document the attacker profile, access rights and external datasets available to them before you use the training set.
2. Test the model for memorisation and extraction — run white-box and query-based extraction tests on the delivered model to detect personal data in weights.
3. Document who may query the model and under which rights — record access assumptions and reassess them if access is widened, since anonymity claims change with context.
4. Assign periodic reassessment — establish a recorded moment at which the anonymity claim is tested again, because new models, sources and attack techniques can overtake the original assumptions.
5. Extend the evidentiary chain across the AI pipeline — involve data specialists, engineers and procurement in the assessment rather than treating anonymisation as a dataset-only task.

What stays your own professional judgement?

No source offers a guarantee that a model never reproduces information after transformation; they substantiate an evidentiary obligation. The distinction between pseudonymisation and anonymisation under the GDPR remains important: separately stored keys, hashes or restricted access rights reduce risk but do not automatically make data anonymous. Where the model runs does not automatically remove extraction risks. Tooling can help you run privacy attacks and record assumptions, but the decision to claim anonymity — and the liability that follows — rests on your assessment of the threat model, the test results and the context in which the model will be used.