On 17 December 2024 the European Data Protection Board adopted Opinion 28/2024opens in a new tab, following a request for clarification from the Irish supervisory authority. It concerns AI models and personal data, and it is the document that put in writing the thing many people had assumed the other way round.
A model is not anonymous because it is a model
The convenient theory was that a model trained on personal data no longer contains personal data once trained: what is inside are numbers, not texts. The Board said that not all models processing personal data can be considered anonymous, and that the threshold for treating one as anonymous is high.
The test has two limbs: the probability of extracting from the model the personal data used to train it must be negligible, and so must the probability of obtaining it through queries. And the assessment has to be made case by case, not by category.
Why this matters to people who train nothing
A professional firm does not train models, so the training part looks like someone else’s problem. It has two practical consequences all the same.
The first is that “the model does not keep anything anyway” stops being a usable answer. If the anonymity threshold is high for the supplier that built the model, it cannot be low for the customer sending a document into it.
The second concerns legitimate interest: the Board examined when it can support training, with the usual three-step test and significant weight given to mitigating measures, among them pseudonymisation and synthetic data, and to transparency towards data subjects. That is the signal that technical measures are not decoration around the assessment: they are part of it.
The point about unlawful initial processing
The opinion also addresses the case where the training data was collected unlawfully, and concludes that where the model has been anonymised the unlawfulness of the initial processing does not carry over to the subsequent operation, because that no longer involves personal data.
It is the most debated part of the document, and it is useful to someone who merely uses a model for one reason: it shows how much of the reasoning rests on the word “anonymised”, which the regulation defines strictly and which commercial language uses loosely.
The judgment that moved the line, and which way
Nine months after the opinion came a ruling that shifts the reasoning from the model to the recipient, and it is the most useful thing said on this subject so far. In its judgment of 4 September 2025 in Case C-413/23 Popens in a new tab, the European Data Protection Supervisor against the Single Resolution Board, the Court of Justice dealt with comments collected by an authority, stripped of identifying data, replaced with an alphanumeric code, and passed on in that form to an outside auditor.
The Court said two things, and they belong together. First: pseudonymised data does not automatically stop being personal, and whoever holds it together with the mapping remains a controller, with the information duties that follow. Second: where the recipient has no means reasonably likely to be used to get back to the individuals, that material may not be personal data for them. The same information, in other words, can be personal data in one pair of hands and not in another.
Applied to a court filing with placeholders in it, that is a description of the job. For the firm, which keeps the dictionary between [FULLNAME_1] and the real name, the text is pseudonymised personal data and the GDPRopens in a new tab applies in full: record, legal basis, measures. For the model provider, which receives a text holding no value that leads back to a person and has no reasonable means of reconstructing one, that text may not be personal data at all.
Which explains why the deciding question is never “did you anonymise it”, it is where is the key. If the mapping is on the firm’s own computer, the separation between the two pairs of hands is real. If it sits on a server belonging to the supplier that also receives the text, the two pairs of hands are the same pair, and the judgment is no help at all.
EDPB Guidelines 02/2026: anonymity as a process, not a technique
The Board then took the subject up itself. Guidelines 02/2026opens in a new tab, adopted on 7 July 2026 and open for public consultation until 30 October, update the Article 29 Working Party’s Opinion 05/2014 and change the framing: anonymity stops being a property a technique confers on a dataset and becomes the outcome of an assessment, redone by looking at who holds the data, what means they reasonably have, and how the context changes over time.
For someone working in a firm the consequence is less theoretical than it sounds, and it is a change of verb. You do not “anonymise a document” once and then send it anywhere forever: you assess whether, in that transfer, to that recipient, any reasonable means of getting back to somebody remains. Which is why a serious tool shows what it found rather than declaring the document clean: the declaration is a promise, the list of values is evidence.
The words worth keeping apart
Anonymisation, under Recital 26, is a transformation after which the person is no longer identifiable by any means reasonably likely to be used. Pseudonymisation, under Article 4(5), is processing after which the data can no longer be attributed to a person without additional information kept separately: the data is still personal, and the regulation still applies.
A tool that replaces names with placeholders and keeps a dictionary does the second, by definition, and calling it anonymisation is the thing that does not survive scrutiny. The full difference is in the piece about the two routes.
Which takes nothing away from the usefulness of pseudonymisation: the opinion itself lists it among the measures that weigh in the assessment. It only removes the shortcut of saying the problem has gone away.