Privacy & Cybersecurity Law Blog

On July 8, 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines on anonymization and draft guidelines on web scraping in the context of generative artificial intelligence (“AI”), and finalized its guidelines on the processing of personal data through blockchain technologies. Together, these measures further clarify how the EU General Data Protection Regulation (“GDPR”) applies in several fast-developing technical areas.

Anonymization

The draft anonymization guidelines aim to clarify when data may be treated as anonymous under EU data protection law. The EDPB reiterates that, under the GDPR, data is anonymous only if it does not relate to an identified or identifiable natural person. The guidelines also note that information may relate to a person by its content, purpose or effect, even where that connection is not immediately obvious.

The guidelines further explain that a person is identifiable if they can be distinguished from others using means reasonably likely to be used. Those means should be interpreted broadly and may include information or capabilities available through a third party. Whether such means are reasonably likely to be used should be assessed based on objective factors and from the perspective of the relevant entity. The guidelines also reflect recent Court of Justice of the European Union (“CJEU”) case law, including the September 4, 2025 judgment in C-413/23 P EDPS v SRB, which clarified the scope of personal data in the context of a transfer of pseudonymized data to third parties.

To help organizations assess whether anonymization is effective, the draft anonymization guidelines set out a practical framework based on two possible approaches: (1) a “contextual approach,” which considers the capabilities of parties that might identify individuals; and (2) a more conservative “simplified approach,” which does not. It also introduces three key criteria for testing anonymity: “no record isolation,” “no linkage” and “no inference.” If all three criteria are met, the data may be regarded as anonymous; if not, additional assessment is required. Finally, Annex 1 of the draft anonymization guidelines includes a flow chart as a support tool to help organizations decide whether a simplified or contextual approach should be taken, and to determine whether data may be considered anonymous or personal.

Web Scraping in the Context of Generative AI

The draft guidelines on web scraping for generative AI confirm that the GDPR applies where scraping involves personal data and highlights the importance of compliance with core GDPR principles. The guidance recommends steps such as scraping from reliable sources, recording collection dates and validating data before using it for AI training. The draft guidelines also address legal basis and note that private entities commonly rely on legitimate interests in this context but must satisfy the balancing test of Article 6.1(f) of the GDPR and implement safeguards as part of this balancing test. The guidance includes practical examples to help organizations assess the balancing test under the legitimate interests basis. In addition, with regard to special categories, controllers must identify both a lawful basis under Article 6 of the GDPR and an applicable condition under Article 9(2) of the GDPR. The EDPB notes that existing CJEU case law may be relevant in limited cases involving incidental and residual collection but stresses that there is no general exemption and that each case must be assessed individually.

Processing of Personal Data Through Blockchain Technologies

The blockchain guidance is intended to help organizations using blockchain technologies evaluate GDPR compliance issues, including how different blockchain architectures may affect the processing of personal data and create risks for data subjects. The guidelines stress the importance of implementing data protection by default and by design measures to give effect to GDPR principles, facilitate the effective exercise of data subjects’ rights and ensure that appropriate technical and organizational measures are in place. They also make clear that storing personal data on a blockchain should be avoided where doing so would conflict with data protection principles. Where such storage cannot be avoided, organizations should consider advanced techniques, appropriate organizational measures and robust data protection policies. The guidelines also examine how the technical aspects of blockchain interact with core GDPR principles. In particular, the guidelines highlight the importance of carrying out a data protection impact assessment before implementing any processing activity involving blockchain technology.

Public Consultation Period

The draft guidelines on anonymization and the draft guidelines on web scraping for generative AI are both open for public consultation until October 30, 2026.

Read the EDPB press release here. See the draft anonymization guidelines here. See the draft web scraping guidelines here. See the blockchain guidelines here.