The cautious answer in European data protection has long been that pseudonymised data stays personal data as long as anyone, anywhere, still holds the key. The EDPB's draft guidelines on pseudonymisation of January 2025 still say it holds even when the data and the key are in different hands. Two newer texts have made that answer more precise. On 4 September 2025 the Court of Justice decided EDPS v SRB (C-413/23 P), and on 7 July 2026 the European Data Protection Board adopted its draft Guidelines 02/2026 on Anonymisation, which are open for comments until 30 October 2026 at 23:59 CET. Read together, they explain when the same file can be personal data for you and anonymous for someone else, and why that rarely helps when the someone else is a service provider working for you.
Below is what the two texts say, with paragraph references, followed by the practical question for law firms, accountants, HR teams and anyone pasting documents into an AI tool: pseudonymise reversibly, or black out for good?
The key facts at a glance
| Item | Verified fact | Source |
|---|---|---|
| EDPB document | Guidelines 02/2026 on Anonymisation, version 1.0 | EDPB PDF, cover |
| Adopted | 7 July 2026, "for public consultation" | version history, p. 1 |
| Consultation | 8 July to 30 October 2026, 23:59 CET (115 days) | EDPB consultation page |
| Length | 103 paragraphs, 25 worked examples, one flowchart annex | EDPB PDF |
| Replaces | Article 29 Working Party Opinion 05/2014 | para 2 |
| Companion text | Guidelines 01/2025 on Pseudonymisation, adopted 16 January 2025, consultation closed 14 March 2025, no final version published yet | EDPB consultation page |
| Court ruling | CJEU, First Chamber, C-413/23 P, EDPS v SRB, 4 September 2025 | judgment header |
| Data in the case | 23,822 comments from 2,855 people; 1,104 comments sent to Deloitte with a 33-digit random code | paras 23 to 26 |
| Legislation | Digital Omnibus, COM(2025) 837: Council mandate of 21 October 2026 drops the new Art. 4(1) wording; Parliament has not voted yet | Council doc. 14756/26; EP Legislative Observatory |
One clarification is needed, because several commentaries describe the 2026 text as guidance on "pseudonymisation and anonymisation". The title and content are about anonymisation only. The word "pseudonymisation" does not appear in the document; pseudonyms are discussed in a single example and in one paragraph about obviously non-anonymous data. Pseudonymisation has its own draft, Guidelines 01/2025, which the 2026 text does not cite.
What the Court decided in SRB
After Banco Popular was resolved in 2017, the Single Resolution Board invited affected shareholders and creditors to comment on its preliminary decision. It received 23,822 comments from 2,855 participants, filtered out 20,101 identical ones, and kept 3,730 individual comments. Of these, 1,104 concerned the valuation and were sent to Deloitte on 17 June 2019 (paras 24 to 26). Each comment carried a randomly generated 33-digit identifier, and only the SRB could link that code to the identity documents collected during registration (paras 23 and 28). Some participants complained that the privacy notice had not named Deloitte as a recipient.
The Court made four points that matter beyond the facts.
Opinions are personal data of the person who expresses them. A personal view is "necessarily closely linked to that person" (para 58), so there is no need to analyse its purpose or effect separately.
Pseudonymised data is not automatically personal for everyone. Pseudonymisation is a risk-reducing measure, not part of the definition of personal data (para 72). Because the key exists, pseudonymised data cannot be treated as anonymous "in all cases" (para 73). But it is equally wrong to treat it as personal "in all cases and for every person" (para 86). For a recipient, the data may be non-personal if two conditions hold: the recipient cannot lift the technical and organisational measures, and those measures actually prevent attribution, including by cross-checking with other information the recipient has (para 77).
Onward transfers pull the data back in. If it cannot be ruled out that a later recipient has means to re-identify, the data is personal for that transfer and for that recipient's processing (para 85).
Transparency is judged from the controller's side, at collection. The SRB had to name Deloitte in its privacy notice when it collected the comments, "irrespective of whether or not those data were personal data" from Deloitte's point of view (paras 111 and 112). On that basis the Court rejected the SRB's main plea, set aside the General Court's 2023 judgment and sent the case back only for a separate plea on good administration (paras 118 to 122).
The judgment interprets Regulation 2018/1725 on EU institutions, whose definition of personal data the Court reads in the same way as Article 4(1) GDPR (para 52).
What the EDPB draft adds
The EDPB builds the SRB reasoning into a general test. Information is anonymous if it does not relate to a person or the person is not identifiable, and "these answers may vary from one entity to another" (para 6). The guiding question for any assessment is "for whom is the data intended to be anonymous?" (para 12). Several paragraphs then narrow the room this relative approach leaves.
Processors inherit the controller's perspective. If an entity processes data on behalf of a controller for whom the data is personal, the data is personal for that entity too, and it is a processor under the GDPR (para 15). The EDPB illustrates this with a retailer that sends extracts to an analysis agency acting on its behalf: personal data for both (Example 3). Only a recipient that decides its own purposes and means, such as an independent research institute, is assessed from its own perspective (Example 4).
The likelihood must be insignificant, not zero. Identification does not need to be impossible, but its likelihood "should be insignificant in reality" (para 22), and means are discounted only when they are impossible, disproportionate in time, cost and labour, or prohibited by law (para 26).
Contracts are not law. A contractual ban on re-identification is not a legal prohibition and can only complement technical measures (para 34). Lack of motivation to re-identify is not a reliable argument either (para 31).
Re-identification is getting cheaper. Most documented techniques run on commodity hardware, and the EDPB expects agentic AI to "further reduce the time and costs" of re-identification (para 92). AI models can also be prompted to reveal information about individuals (para 82).
Three criteria. Data passes if there is No Record Isolation, No Linkage and No Inference; if all three are met it "can be safely considered anonymous" (para 52). The test can be run in a contextual way, entity by entity, or in a simplified way that ignores differences between entities and is more conservative (paras 45 to 47).
Words and records. Controllers should not call data "anonymous", "de-identified" or "de-personalised" when people remain identifiable (para 40), and they should document the anonymisation process and its testing and keep that documentation (para 41). Assessments made under the 2014 Opinion do not have to be redone (footnote 3).
How the 2025 and 2026 drafts fit together
The two EDPB drafts were written on either side of the judgment, and it shows. Guidelines 01/2025 state that pseudonymised data remains personal even when the data and the additional information are "not in the hands of the same person" (para 22). The Court then held that pseudonymised data is not personal "in all cases and for every person". The 2026 draft follows the Court and cites SRB in ten footnotes, but it does not mention the 2025 text, and the 2025 text has not been finalised. Until the pseudonymisation guidelines are updated, organisations will read 01/2025 for the mechanics of pseudonymisation (pseudonymisation domains, secrets, lookup tables) and 02/2026 plus SRB for the question of who the data is personal for.
The practical common ground is wider than the tension suggests. Both texts agree that the controller who holds the key always processes personal data (01/2025 executive summary; 02/2026 para 37), that a mapping or lookup table is itself personal data that must be protected (01/2025 para 93), and that pseudonymisation is valuable as a safeguard under Articles 25 and 32 GDPR even when it does not take data out of scope.
The Digital Omnibus: the legislature takes up the question
The relative approach is now also before the EU legislature. On 19 November 2025 the Commission proposed the Digital Omnibus, COM(2025) 837 (procedure 2025/0360 (COD)), which would add three sentences to the definition of personal data in Article 4(1) GDPR. The central one says that information "shall not be personal for a given entity where that entity cannot identify the natural person", taking into account the means reasonably likely to be used by that entity. The last one adds that the information does not become personal for that entity merely because a potential subsequent recipient could identify the person (Article 3(1) of the proposal). The Commission presents this as codifying the case law on pseudonymisation (Explanatory Memorandum, pp. 10 and 11), and a new Article 41a would let it decide by implementing act when pseudonymised data stops being personal for certain entities.
The EDPB and the EDPS rejected both ideas in Joint Opinion 2/2026 of 10 February 2026. In their view the text picks "a single element from a single case" (para 15), and its last sentence goes beyond SRB, where the Court confirmed that data made available to a recipient able to identify becomes personal for that recipient and, indirectly, for whoever made it available (para 16, citing SRB paras 84 and 85). They urged the co-legislators not to adopt the change (para 21), asked for Article 41a to be deleted (para 25), and said the open questions belong in EDPB guidance (para 19). One of the questions they listed, whether a recipient that cannot identify anyone but works on behalf of a controller is a processor (footnote 29), is the one Guidelines 02/2026 later answered in para 15.
The Council takes a different route from the Commission. Its negotiating mandate, agreed by Coreper on 21 October 2026 (Council document 14756/26), strikes the new sentences in Article 4(1) and replaces Article 41a with a new Article 25a on pseudonymisation. Pseudonymised data is not personal for a third party that cannot identify the person (Article 25a(2)); if that third party passes it to someone who can, both the transfer and the later processing involve personal data (25a(3)); and for a processor acting for the controller it is always personal data (25a(4)). Instead of implementing acts, the EDPB would issue an opinion on pseudonymisation and anonymisation (25a(6)). In the European Parliament the joint ITRE and LIBE committees have a draft report but had not voted as of 27 October 2026, so trilogues have not started and none of this is law yet.
| Text | Date and status | What it says on pseudonymised data |
|---|---|---|
| CJEU, EDPS v SRB, C-413/23 P | Judgment, 4 September 2025 | Not personal "in all cases and for every person" (para 86) |
| EDPB Guidelines 01/2025 | Draft of 16 January 2025, not finalised | Personal even when data and key are in different hands (para 22) |
| EDPB Guidelines 02/2026 | Draft of 7 July 2026, comments until 30 October 2026 | Relative test, but always personal for a processor (para 15) |
| Commission, Digital Omnibus, COM(2025) 837 | Proposal, 19 November 2025 | Relative wording in Art. 4(1); implementing acts under Art. 41a |
| EDPB-EDPS Joint Opinion 2/2026 | 10 February 2026 | Do not adopt the new definition; delete Art. 41a (paras 21, 25) |
| Council mandate, doc. 14756/26 | Coreper, 21 October 2026 | Art. 4(1) unchanged; new Art. 25a, personal for processors (25a(4)) |
| European Parliament, ITRE and LIBE | Draft report, no committee vote by 27 October 2026 | No position adopted yet |
Read side by side, the texts converge more than the debate suggests. The Court accepted that identifiability depends on who holds the data (SRB para 86). The EDPB turned that into a test that keeps service providers inside the GDPR (02/2026 para 15). The Council's text would write the same limits into the Regulation itself. The only wording that would have treated onward transfers more loosely, the Commission's third sentence, has the support of neither the supervisory authorities nor the Council. For anyone deciding today how to prepare a document for an AI tool or a third party, SRB and the two EDPB drafts remain the reference.
Reversible pseudonymisation or permanent anonymisation
Most document work falls into one of two patterns, and SRB does not change which one fits a given task.
Reversible pseudonymisation replaces names, identifiers and other details with consistent placeholders, while the controller keeps a mapping table. It is the right choice when you need the real values back: drafting a reply, analysing a contract, summarising a case file with an AI assistant, or handing a workpaper to a colleague who will later need to know who is who. For you, the document is still personal data. For a provider that processes it on your behalf, it is also personal data (para 15), which means a data processing agreement is still required. What pseudonymisation buys you is data minimisation and security: the provider sees far less, and a leak or misuse on its side exposes placeholders rather than identities.
Permanent anonymisation or blackout removes the information with no key left anywhere, including document metadata. It is the right choice when the document leaves your control for an independent recipient: publication, disclosure to an opposing party or a court, a response to a subject access request that must protect third parties, a research or training dataset. Here SRB and 02/2026 matter most, because the recipient's perspective counts, and the three criteria tell you what to check: whether a single record still stands out, whether it can be linked to other sources, and whether something specific can be inferred.
| Situation | Who receives it | Typical choice | Personal data for the recipient? |
|---|---|---|---|
| Drafting or analysis with an AI service acting for you | Processor | Reversible pseudonymisation | Yes (para 15); DPA needed |
| Workpaper shared inside the firm | Your own staff | Reversible pseudonymisation | Yes, but exposure is reduced |
| Court filing, publication, disclosure to a counterparty | Independent third party | Permanent blackout | Only if re-identification is reasonably likely (paras 21, 22) |
| Dataset for an independent researcher | Independent third party | Anonymisation tested on the three criteria | Assessed from the recipient's perspective (Example 4) |
What this means in practice
Law firms. Pleadings and exhibits that go to a court or an opposing party need permanent redaction, and the test is whether the opposing party, a journalist or anyone else who will read the file can still identify the person (para 30 lists investigative journalists, colleagues and neighbours among the parties to consider). Free-text details are the usual weak point: a job title, a date and a town can single someone out even without a name, which is exactly the No Record Isolation problem. For internal drafting with AI tools, reversible pseudonymisation keeps client names out of the provider's systems without losing the ability to restore them.
Accountants and tax advisers. Ledgers and payroll exports are structured data, so the three criteria apply almost literally: a column with a tax number or IBAN is an identifier, and a combination of salary, start date and department can isolate a record. Pseudonymising at column level preserves the arithmetic while removing identifiers. When files go to an external reviewer acting for you, remember that the reviewer is a processor and the data stays personal.
HR. Employee surveys and investigations are a recurring source of false anonymity. The EDPB gives the example of a team survey where aggregated scores still reveal what every member thought (Example 17), and SRB confirms that opinions are personal data of their author. If results are shared with managers, aggregate thresholds and suppression of small groups matter more than removing names.
Anyone sending documents to AI tools. An AI provider that processes your prompts on your instructions is, on the EDPB's reading, a processor for whom the data stays personal. Pseudonymisation does not remove that relationship, but it changes what is exposed. Two details deserve attention: whether the mapping table ever leaves your control, and whether the provider retains or trains on inputs. The EDPB's warning about prompting AI models to extract information on individuals (para 82) is a reminder that what goes in can come out.
Tools such as Redactic implement both patterns on the same file: reversible placeholders for AI work, with the real values restored only in the user's browser, and permanent blackout with metadata removal for documents that leave the organisation, and a redaction certificate with document hashes for each operation, which helps with the record keeping that para 41 describes.
Frequently asked questions
Is pseudonymised data still personal data after SRB?
For the controller who holds the key, yes, always. For a recipient, it depends: the data can be non-personal for an independent recipient who cannot lift the pseudonymisation or re-identify by cross-checking (SRB paras 77 and 86), but it is personal for any processor working on the controller's behalf (02/2026 para 15).
Are Guidelines 02/2026 about pseudonymisation?
No. They are guidelines on anonymisation. Pseudonymisation is covered by Guidelines 01/2025, adopted for consultation on 16 January 2025 and not yet finalised.
When does the EDPB consultation close and how do I respond?
On 30 October 2026 at 23:59 CET, through the form on the EDPB consultation page. Responses are published on the EDPB website.
Does a contract forbidding re-identification make data anonymous for the recipient?
Not by itself. The EDPB says a contractual prohibition is not a prohibition by law and can only complement technical measures (para 34).
Will the Digital Omnibus change the GDPR definition of personal data?
Not yet, and probably not in the form first proposed. The Commission's proposal COM(2025) 837 would add a relative test to Article 4(1) GDPR. The EDPB and the EDPS asked the co-legislators not to adopt it (Joint Opinion 2/2026, para 21), and the Council's negotiating mandate of 21 October 2026 deletes it in favour of a new Article 25a, under which pseudonymised data stays personal for processors and for onward transfers to anyone able to identify. The European Parliament has not yet adopted its position, so trilogues have not started. Until a text is adopted, SRB and the EDPB guidelines are the reference.
Do I need to redo anonymisation assessments made under the 2014 Opinion?
No, according to footnote 3, although periodic reassessment is recommended because re-identification becomes easier over time (para 35).
If you work with client, employee or patient documents and want to try both approaches on your own files, you can start at redactic.eu. Detection and redaction run on Redactic-controlled infrastructure in Europe, and optional AI tasks are a separate step that works on the prepared text.
How to cite this article
Redactic. "Pseudonymised or Anonymous? EDPB 02/2026 and the SRB Ruling." redactic.eu, October 2026. https://redactic.eu/blog/pseudonymisation-anonymisation-edpb-guidelines-02-2026-srb/
Primary sources: EDPB Guidelines 02/2026 on Anonymisation (v1.0, 7 July 2026); EDPB Guidelines 01/2025 on Pseudonymisation (16 January 2025); CJEU, C-413/23 P, EDPS v SRB, 4 September 2025; European Commission, Digital Omnibus, COM(2025) 837 final, 19 November 2025; EDPB-EDPS Joint Opinion 2/2026, 10 February 2026; Council of the EU, doc. 14756/26 (negotiating mandate), 22 October 2026.
Related guides
- Data Redaction Guide 2026: How to Mask PII for GDPR and AI Compliance
- Shadow AI in HR: How to Use AI Tools Without GDPR Violations (2026)
- Contract Redaction Guide: Litigation, Witnesses, Sensitive Clauses (2026)
- Document Redaction for Accountants: Payroll, Tax IDs, GDPR Workflow (2026)
See how Redactic puts this into practice: Redactic document redaction ยท Trust pages and DPA.