Anonymised data: can re-identification risk change after an export?

A dataset may contain no names or email addresses and still qualify as personal data. The problem often emerges after sharing: the recipient may hold auxiliary information that the sender does not, or may be able to combine several datasets.

On 7 July 2026, the European Data Protection Board adopted draft Guidelines 02/2026 on Anonymisation. Public consultation remains open until 30 October 2026. The draft is not a newly binding final rule; it offers a proposed analytical framework to read alongside the GDPR and case law.12

What matters is not just what you removed

Imagine exporting building occupancy data. Names and direct identifiers are removed, but each record still contains a precise timestamp, an area and a visit frequency.

A partner with access to staff schedules might identify certain people. Another recipient without those schedules may find this far harder. The same dataset need not pose identical identification risks in every context.

In its 4 September 2025 judgment in case C-413/23 P, the Court of Justice highlighted the relevance of means reasonably likely to be used by a recipient to identify individuals. It would be wrong either to assume all pseudonymised data is anonymous or to declare it personal data for every recipient without considering the circumstances.3

Three tests before calling data anonymous

The EDPB draft considers whether records or individuals can be singled out, whether records can be linked with each other or other information, and whether information can be inferred about a person. If one test raises concerns, further assessment is required; it does not automatically settle the legal classification.2

In our example, an unusual combination of area, time and frequency may single someone out. Badge records or calendars could enable linkage. Repeated visits could reveal sensitive patterns.

The assessment must therefore document the actual sharing context rather than rely on a generic technical transformation.

Five decisions before exporting

1. Define the purpose. Which columns does the recipient truly need? Would daily totals work instead of minute-level events?

2. Understand the recipient. What additional information is available to them? Could they obtain public or internal datasets? Are contractual restrictions meaningful in practice?

3. Test combinations. Look for rare records, unique trajectories and attributes that support inferences. Removing names is not a sufficient test.

4. Reduce exposure. Aggregate, remove attributes, broaden time or location buckets and restrict access. Assess each measure against utility and residual risk.

5. Record the decision. Keep the dataset version, recipient, assumptions, tests, limitations and review date. New auxiliary information or a new use may change the assessment.

Anonymisation is not the same as pseudonymisation

Replacing a person's identifier with a stable code can still make records linkable. If a key or auxiliary information allows identification through reasonably likely means, the output must not automatically be considered anonymous.

True anonymisation requires a contextual assessment of identification risk. Where data remains personal, GDPR obligations still apply. Contracts and access restrictions can inform the assessment, but do not replace technical scrutiny.

The useful conclusion is not “we removed the names”, but “we can explain why this recipient cannot reasonably identify individuals in this context”.

This article discusses draft EDPB guidelines under consultation as of 9 October 2026. Recommendations may change before final adoption.