The EDPB has issued its new Guidelines on Anonymisation, and they could have major implications for AI systems, AI training data and GDPR compliance.
In this episode of the Legal Break, Giulio Coraggio discusses the new EDPB Guidelines with journalist Antonio Ravenna and explains what they mean in practice for organisations developing or deploying AI.
Among the key issues discussed:
• When can data really be considered anonymous under the GDPR? • Why anonymisation is relative and context-dependent • The EDPB's three criteria: No Record Isolation, No Linkage and No Inference • Why AI models and synthetic data create new re-identification risks • How AI can make inference and re-identification easier • Why simply removing names and identifiers may not be enough • What the Guidelines mean for AI developers and businesses using personal data • Why organisations should periodically reassess whether data remains anonymous • The relationship between the EDPB's anonymisation guidance and its approach to AI and web scraping
The EDPB Guidelines 02/2026 were adopted in July 2026 and are currently open for public consultation until 30 October 2026.
The key message: anonymisation is no longer something organisations can assume; it needs to be demonstrated, tested and reassessed.
Podden och tillhörande omslagsbild på den här sidan tillhör
Giulio Coraggio. Innehållet i podden är skapat av Giulio Coraggio och inte av,
eller tillsammans med, Poddtoppen.
