EDPB Opinion 28/2024, para 134: a claim of anonymity must be shown (EDPB Opinion 28/2024, adopted 17 December 2024, para 134)
Calling a dataset or model anonymous does not make it so. A holder that says its lot is anonymous should hold the test, the method and the residual-risk assessment behind that claim.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“However, the EDPB emphasises that a mere assertion of anonymity of the model is not enough to exempt it from the application of the GDPR, and notes that SAs should assess it taking into account, on a case-by-case basis, the considerations provided by the EDPB to address Question 1 of the Request.”
Where it was read
Also read from the same source
- EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented (EDPB Opinion 28/2024, adopted 17 December 2024, para 66)
- EDPB Opinion 28/2024, para 92: a privacy notice is not enough to create expectations (EDPB Opinion 28/2024, adopted 17 December 2024, para 92)
- EDPB Opinion 28/2024, para 101: masking and substituting personal data (EDPB Opinion 28/2024, adopted 17 December 2024, para 101(c))
- EDPB Opinion 28/2024, para 102: a waiting period and an unconditional opt-out (EDPB Opinion 28/2024, adopted 17 December 2024, para 102(a)-(b))
- EDPB Opinion 28/2024, para 114: corrective measures can reach the whole dataset (EDPB Opinion 28/2024, adopted 17 December 2024, para 114)
- EDPB Opinion 28/2024, para 129: the next party must check where the data came from (EDPB Opinion 28/2024, adopted 17 December 2024, para 129)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides