“We removed the names, so it is anonymised and the GDPR no longer applies” is the most consequential claim anyone makes about a training corpus, because if it is right the entire Regulation switches off and if it is wrong nothing about the processing was ever assessed. The test that decides it is not about which fields were dropped.
The line the GDPR draws
Pseudonymisation is defined in Article 4(5) as the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring non-attribution. Pseudonymised data is still personal data. Article 4(5) sits in the definitions precisely because pseudonymisation is a security and minimisation measure — Article 25(1) names it as an example of one — not an exit from scope.
Anonymous information is dealt with in Recital 26, which says the principles of data protection should not apply to information which does not relate to an identified or identifiable natural person, or to personal data rendered anonymous in such a manner that the data subject is not or is no longer identifiable. The same recital sets the test: to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, either by the controller or by another person, to identify the person directly or indirectly — considering all objective factors, including the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The full text is at EUR-Lex, Regulation (EU) 2016/679.
Whether a specific dataset is anonymous is a factual and legal assessment about that dataset, and it is not one a general page can make for you. Nothing here is legal advice; a claim that a corpus is anonymous is one you may have to defend, and it should be assessed and documented before it is relied on.
The practical significance of getting this wrong is total rather than incremental. If the corpus is personal data, you needed a lawful basis to create it, transparency obligations under Articles 13 and 14 attach, data subject rights apply to it, retention limits apply, and transfers of it engage Chapter V. If it is genuinely anonymous, none of that applies. There is no middle setting.
Means reasonably likely to be used
The leading authority on the test is Case C-582/14, Breyer, judgment of 19 October 2016, where the Court of Justice held that a dynamic IP address held by a website operator was personal data in relation to that operator where it had legal means enabling it to identify the visitor with the help of additional information held by the internet service provider — see curia.europa.eu for C-582/14. Two things follow. The test is relative: it asks about the means available to this holder, not about metaphysical possibility. And it reaches beyond the holder’s own data: means available through a third party count where obtaining them is reasonably likely, and the Court treated the existence of a lawful route to that third party as decisive.
The relative approach was examined again in Case C-413/23 P, EDPS v Single Resolution Board, in which the Court of Justice gave judgment in 2025 on appeal from the General Court’s decision in Case T-557/20. The proceedings concerned pseudonymised comments transmitted to a recipient that did not hold the re-identification key, and whether they were personal data in the hands of that recipient. The docket is at curia.europa.eu for C-413/23 P. The reasoning is more careful than either side’s summary of it, and anyone relying on the case should read the judgment rather than a description of it; in particular, the perspective from which identifiability is assessed and the perspective from which a controller’s own transparency duties are assessed are not necessarily the same.
Case law on identifiability is moving. Check the current status of C-413/23 P and of any subsequent references before relying on the position summarised here, and read the judgments themselves.
Singling out, linkability, inference
The operational test regulators apply comes from the Article 29 Working Party’s Opinion 05/2014 on anonymisation techniques, which asks three questions of any purportedly anonymous dataset and treats a yes to any one of them as fatal to the claim.
- Singling out. Is it possible to isolate some or all records identifying an individual in the dataset? Note that this does not require knowing who the person is. A corpus in which one record is distinguishable as belonging to one individual fails this even if no name appears anywhere in it.
- Linkability. Is it possible to link at least two records concerning the same person, either within the dataset or across two datasets? Two support transcripts recognisably from the same customer are linkable.
- Inference. Is it possible to deduce, with significant probability, the value of an attribute from the values of other attributes? This is the risk that survives the most aggressive field removal, because it does not depend on identifiers at all.
Applied to a training corpus rather than to a database table, the results are uncomfortable. Free text is the hardest possible case for all three: a support ticket describing a specific order, a specific complaint and a specific location singles out its author without containing a name, and writing style itself is a linkability vector across documents. Removing direct identifiers from natural language reduces risk without approaching the standard Recital 26 sets, and a corpus described as “de-identified” is almost always pseudonymised in the Article 4(5) sense — which means it is still personal data, and the retention and purpose questions in retention limits for training data still apply to it.
The EDPB published draft guidelines on pseudonymisation for consultation in January 2025, available from the EDPB’s document register; check whether they have been finalised, since a final version may change the emphasis of the analysis above.
Does the model itself contain personal data
The question one step beyond the corpus is whether the trained weights are personal data. It matters directly: if they are, an erasure request reaches them, and a model transfer is a data transfer.
The European Data Protection Board addressed it in Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, adopted in December 2024 at the request of the Irish supervisory authority. Its position is that an AI model trained on personal data cannot in all cases be considered anonymous; that anonymity has to be assessed case by case; and that for a model to be regarded as anonymous, both the likelihood of directly extracting personal data of individuals whose data was used to train it, and the likelihood of obtaining such data from queries, should be insignificant — assessed using means reasonably likely to be used. That is a factual test about a specific model rather than a categorical answer either way.
There is a reasoned dissent from that framing worth knowing about. The Hamburg data protection authority published a discussion paper in 2024 arguing that large language models do not themselves store personal data in the relevant sense, because the weights encode statistical relationships between tokens rather than records about individuals — on which view obligations attach to the training processing and to the outputs, but not to the model artefact. That position has not been adopted by the EDPB, and it has not been rejected by a court either.
What is unresolved, and what would settle it
Three questions here are genuinely open, and a page that presented them as settled would be worse than useless.
Whether the weights of a large model constitute personal data is contested between supervisory authorities, as above. What would settle it is a decision of the Court of Justice, most likely arriving through a reference in a case about an erasure or access request against a model provider. Until then, the EDPB’s case-by-case test is the position a supervisory authority is most likely to apply, and the memorisation and extraction literature is the evidence the test would be run against.
Whether a model that has been trained on unlawfully processed data can lawfully be deployed is also open. Opinion 28/2024 addresses the consequences of unlawful processing in the development phase for the subsequent deployment phase, and the answer it gives depends heavily on whether the model is genuinely anonymous and on whether the deploying entity is the same as the developing one. It is not a clean rule, and applying it to a specific commercial model requires facts about the training that the deployer usually does not have.
And whether a synthetic dataset generated from personal data is anonymous has no settled answer at all. It plainly can fail the inference test, and it plainly can be constructed so as to pass; where an individual generator falls is an empirical question about that generator. A claim of anonymity for synthetic data should be tested rather than asserted, and the claim should be documented with the test, because the party asserting it carries the accountability burden under Article 5(2). The neighbouring question of what an access request can actually reach in a trained model is worked through in access requests against a trained model, and the basis question for building the corpus in the first place is in legitimate interest assessments for AI training.
Top comments (0)