Written by: Haim Ravia, Dotan Hammer
The European Data Protection Board (EDPB) published its report on the stakeholder event on anonymization and pseudonymization held on December 12, 2025. The remote event gathered input from 115 participants spanning industry, NGOs, academia, law firms, and public sector bodies to inform the EDPB’s ongoing work on its Guidelines 01/2025 on Pseudonymization and forthcoming guidance on anonymization.
The event was convened following the Court of Justice of the European Union’s judgment in EDPS v. SRB (C-413/23 P), which clarified aspects of the scope of the concept of personal data. Participants were organized into breakout groups to address key questions identified in a discussion paper the EDPB had published prior to the event.
The report identifies several areas where stakeholders sought greater clarity. These include how to determine the relevant perspective for assessing identifiability in specific use cases, what constitutes “means reasonably likely to be used” to re-identify individuals, and how onward transmissions of data may affect identification risks. Stakeholders noted that contractual obligations, while useful, may be insufficient where parties have different technical capabilities, and emphasized the importance of robust audit frameworks, including third-party audits and regular re-evaluation every two to three years.
Participants also debated whether a separate legal basis under Article 6 of the GDPR is needed for the transmission of pseudonymized data or the act of anonymization itself. While the report does not provide definitive guidance, it identifies the issues likely to be addressed in forthcoming EDPB guidelines. Both sets of guidelines on anonymization and pseudonymization are listed in the EDPB’s Work Program 2026–2027.
Click here to read the EDPB’s Report on the Stakeholder Event on Anonymization and Pseudonymization.
