When is an anonymised dataset truly anonymous with AI?

You must now treat any dataset previously classified as anonymous as potentially re-identifiable if new models, public sources or linking information have become available since that classification. Periodic reassessment is no longer optional; it is a concrete obligation under the EDPB's 2026 framework.

The EDPB's 2026 guidelines on anonymity testing of 23 October 2026 sets out that data is anonymous only when records cannot be isolated individually, cannot be linked to other data and give rise to no meaningful inferences, arguing that technological development and additional public context must inform every assessment. The framework was prompted by an academic study demonstrating an automated pipeline that extracts identity clues from pseudonymous posts, cross-references them against public web information and confirms matches at scale. In our assessment, this development means you cannot treat anonymisation as a one-time classification; you must instead build reassessment into your data governance as a standing control, triggered whenever new models, datasets or scraping capabilities emerge.

What makes a dataset truly anonymous under the new framework?

The EDPB sets three criteria, all of which must be met. A record must not be isolable—that is, it cannot be singled out from the dataset. It must not be linkable to other information that could identify the individual. And it must not give rise to meaningful inferences about the individual. The assessment is carried out from the perspective of the relevant actor—the person or organisation holding the data—and the means that actor can reasonably deploy. This last phrase is critical: as new AI models become available, what counts as "reasonable" means shifts. An actor who could not previously re-identify a record may now be able to do so using a language model and public web sources.

Which failure modes does AI re-identification create?

• Record isolation — an individual can be singled out from the dataset even without a name or direct identifier.
• Linkage through external sources — pseudonymous data can be connected to identified individuals by cross-referencing public information, web posts or other datasets.
• Inference from context — a language model reconstructs missing links by combining scattered clues from the dataset with information available in public sources.
• Rare combinations of indirect identifiers — date of birth, gender, location or other quasi-identifiers that appear in few records can narrow the dataset to a single person.
• Temporal drift — a dataset classified as anonymous becomes re-identifiable as new models, datasets or web-scraping capabilities become available after classification.

What controls must you be able to demonstrate?

1. Document the anonymity assessment explicitly — record which criteria were tested, what means were considered reasonable at the time, and which external sources or linking files were evaluated.
2. Assess rare combinations and record uniqueness — do not check only name fields; include indirect identifiers and map which combinations of attributes appear in few or single records.
3. Set a trigger for reassessment — establish a documented process that forces re-evaluation whenever new AI models, new datasets or broader web-scraping capabilities become available.
4. Specify permitted AI access and external sources in data agreements — record in contracts which additional sources a recipient may use and which AI systems may process the data, naming the residual re-identification risks.
5. Manage pseudonymisation keys and linking information separately — ensure that codes, keys and any additional information that could restore identity are held under separate access controls and documented as personal data.

How does pseudonymisation differ from anonymisation?

Pseudonymisation replaces direct identifiers with codes but does not produce anonymity. The data remains personal data because the link can be restored. The critical shift that AI introduces is that the link no longer has to be restored from a single key file held by the controller. A language model can reconstruct the missing link by inferring it from public sources. This moves the re-identification risk from "who holds the key" to "what can be inferred from available context." An organisation that treats pseudonymised data as anonymous and shares it without assessing linkability to public sources now carries a material re-identification risk.

When should you reassess a dataset you classified as anonymous?

The EDPB explicitly recommends periodic reassessment because technological development and additional information can increase the chance of identification. You should trigger a reassessment as soon as new models become available that could perform inference at scale, new datasets or web sources become accessible that could link records, or your organisation's own access to scraping or linking tools changes. A one-off anonymity statement is not a durable safeguard. The privacy officer should therefore own the trigger mechanism and ensure that datasets do not remain in use under an outdated classification.

Tooling can help you track which datasets exist, when they were classified and which models or sources have become available since. What tooling cannot do is make the professional judgement on whether a particular combination of attributes, in the hands of a particular actor with particular means, still qualifies as anonymous. That remains your responsibility.