When is an anonymised dataset still truly anonymous in the age of AI?

A dataset is only anonymous when records cannot be isolated, linked or traced to meaningful inferences; the EDPB sets this out in its 2026 guidelines, now that research shows language models string scattered clues and public sources together. Decision-makers must periodically reassess re-identification risks as new models or datasets become available.

The trigger is a combination of two developments. On 7 July 2026, the European Data Protection Board (EDPB) adopted its Guidelines 02/2026 on Anonymisation, with an assessment framework that tests anonymity against three questions. At the same time, an academic study on arXiv describes how language models link clues from pseudonymous online posts to public web information in order to identify real people. Together they show that removing names does not produce anonymity and that re-identification remains a real risk.

What exactly do the EDPB's 2026 guidelines establish about anonymity?

The EDPB sets out three criteria: data is only anonymous when a record cannot be isolated individually, cannot be linked to other data and gives no rise to meaningful inferences. If one of those criteria is not met, the organisation must analyse further. The assessment is carried out from the perspective of the relevant actor and the means that actor can reasonably deploy.

In its explanatory note of 8 July 2026, the EDPB explicitly links this framework to web scraping and generative AI. The core is that additional information and public context form part of the factual assessment. The regulator also recommends periodically reassessing the re-identification risk, because, as the guidelines put it, technological development and additional information can increase the chance of identification.

How can language models trace seemingly anonymous data back to individuals?

The arXiv study describes an automated pipeline in which an AI system extracts identity-related clues from pseudonymous posts, locates candidates through web searches and then confirms those candidates. In the evaluation described in the research, the method correctly identified 226 of 338 individuals—about 67 per cent recall—with around 90 per cent precision among the identifications it made, under the reported test conditions; the evaluation used profiles whose real identity was verifiable in advance.

Important nuance: those figures come from a controlled set-up in which the real identity was verifiable in advance. It is therefore not a universal re-identification rate for every dataset. In our analysis, the significance lies not only in the exact percentage but also in the fact that the study demonstrates a repeatable, automated pipeline that can operate at scale. Our analysis: this may change which means an actor can "reasonably" deploy, and is thereby relevant to the standard the EDPB applies.

Why is pseudonymisation not anonymisation, and why is that distinction now compelling?

Pseudonymisation replaces direct identifiers with codes, but the data remains personal data because additional information can restore the link. In its guidance Data access and re-identification risk intervention, NHS England emphasises that the key and other additional information must be managed separately. A file without names can therefore still be identifiable and susceptible to re-identification.

Hong Kong's privacy regulator additionally points to indirect identifiers, such as the combination of date of birth and gender, and advises organisations to assess rare combinations and map external linkability. Our analysis here: the distinction becomes compelling because AI no longer has to obtain the linking information from a single key file. The model reconstructs the missing link from public sources. This shifts the re-identification risk from "who holds the key" to "what can be inferred from available context".

What does this mean for directors, lawyers and CISOs, and what should they do now?

Our analysis: when new models, datasets or other available means may change the re-identification risk, we recommend that controllers have datasets previously classified as anonymous reassessed before they share them again or deploy them for AI processing. Because a record without a name can still be isolable or linkable, an organisation that checks only name fields runs a real re-identification risk; on our reading, the privacy officer should therefore explicitly include rare combinations, record uniqueness and possible linkage files in the assessment. Because generative AI can make meaningful inferences from context, it is not enough simply to call data "anonymous" in a contract; our analysis: the lawyer should therefore record in data agreements which additional sources and which AI access are permitted and name the residual risks. And because the EDPB recommends periodic reassessment, a one-off anonymity statement is not a durable safeguard; on our reading, the CISO should therefore set up a trigger that forces a reassessment as soon as new models, new datasets or broader web-scraping capabilities become available.

Translated into a workable order:

• Inventory direct and indirect identifiers, and test for record uniqueness and rare combinations.
• Map possible linkage files and public sources that an actor could consult.
• Manage the pseudonym key and additional information separately and restrict access.
• Limit AI systems to the necessary context and check which inferences they can make, as explained in how language models can leak personal data despite privacy instructions.
• Carry out actor-focused re-identification tests and document uncertainty and limitations.
• Repeat the assessment when there are new models, datasets or a changed data context.

More background on this type of risk is available in our topic hub on AI privacy and GDPR. Handle external sources by treating external content as untrusted data, and ensure that your records genuinely demonstrate the assessment rather than merely logging activity; in doing so, weigh when logging actually demonstrates control. The professional final judgement on the classification remains with the controller.

Sources: The article draws on the EDPB's guidelines and explanatory note on anonymisation (2026), an arXiv study on LLM de-anonymisation and practical guidance from NHS England and Hong Kong's privacy regulator.