Recital 26 explains when data is truly anonymous under the GDPR: the person must not be identifiable by any means reasonably likely to be used, taking account of costs, time, available technology, and likely developments. Practitioners should test re-identification risk, strip linkability, and treat pseudonymised data as personal data unless identification is no longer reasonably possible.
What Recital 26 is actually deciding
recital 26 is the GDPR’s test for whether data has crossed from personal data into truly anonymous data. The key question is not whether identification is inconvenient, but whether a person can still be identified by means reasonably likely to be used, taking account of cost, time, available technology, and expected future developments.
That makes Recital 26 a practical risk test rather than a label. It asks you to look at the realistic re-identification path, not just the dataset in isolation. If a dataset can still be tied back to a person through auxiliary data, linkage, inference, or repeatable identifiers, it usually remains within GDPR scope.
The important distinction is that pseudonymisation lowers exposure but does not, by itself, make data anonymous. If there is still a plausible route back to a person, the data should be treated as personal data and governed accordingly. For teams handling sensitive or regulated datasets, NHIMG’s GDPR Compliance Guide for Security Teams is a useful companion for the broader security controls that sit around that assessment.
How to apply the “reasonably likely” test in practice
Practitioners usually need to test three things: whether direct identifiers have been removed, whether the remaining attributes still create linkability, and whether an external party could combine the dataset with other information to re-identify a person. The legal standard is contextual, so the answer can change as data, tooling, and available reference sources change.
That is why Recital 26 should be applied as a living assessment, not a one-time classification. A dataset that is effectively anonymous today may become re-identifiable later if new datasets, public records, or analytic techniques make linkage easier. Conversely, a dataset may remain personal data even after obvious identifiers are stripped if quasi-identifiers still make individuals stand out.
Security teams often underestimate how much linkability matters. If the same person can be singled out by a stable combination of traits, transaction patterns, location history, or rare events, the practical anonymity claim becomes weak. The assessment should therefore consider the full attack surface for re-identification, not just obvious fields like names and account numbers.
For privacy programmes, the useful question is whether the organisation can defend the anonymity claim if challenged. That means documenting the assumptions behind the assessment, including what auxiliary data was considered, what technical barriers exist, and why the chosen controls make identification no longer reasonably possible.
Why this matters for compliance, sharing, and downstream use
Recital 26 drives how organisations decide whether they can share, publish, analyse, or retain data under GDPR obligations. If the data is anonymous in the legal sense, GDPR does not apply to that data as personal data. If it is only pseudonymised, or if identification remains reasonably possible, the full GDPR treatment still applies.
That distinction matters when data is being used for analytics, security monitoring, research, or dataset publishing. A common failure mode is treating a reduced-risk dataset as if it were outside scope, then discovering that a partner, recipient, or attacker can re-link it using another dataset they already have. The more sensitive the context, the more conservative the re-identification analysis should be.
Current GDPR guidance is also shaped by broader privacy controls such as EU General Data Protection Regulation (GDPR), especially the principles around minimisation, privacy by design, and security of processing. Recital 26 does not replace those duties, it helps determine whether the data remains inside the regime at all.
Risk and Threat Considerations
Recital 26 is often misread as a technical de-identification checklist, but the real risk is overclaiming anonymity. If re-identification is still reasonably feasible, organisations may expose themselves to unlawful processing, data sharing mistakes, and a false sense of safety about secondary use or publication.
Failure mechanism: linkable attributes, external reference datasets, and improving analytics can re-identify people even after direct identifiers are removed, especially where the same data can be joined to other records or where rare patterns remain visible.
Impact: the organisation may lose GDPR protections it assumed it had, face unlawful-disclosure risk, and create a residual privacy exposure that persists even after the original identifier fields were stripped.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Article 25 — Data protection by design and by default | Recital 26 depends on privacy-by-design decisions that reduce identifiability. |
| Article 32 — Security of processing | The anonymity assessment depends on technical and organisational safeguards that constrain re-identification risk. | |
| Article 5 — Principles relating to processing of personal data | Recital 26 turns on whether the data is still personal data and therefore subject to GDPR principles. | |
| Recommendation — Design datasets to minimise linkability before relying on any anonymity claim. Apply controls that reduce the chance a dataset can be re-identified. Treat re-identifiable datasets as personal data and process them under GDPR principles. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | Protecting stored datasets limits exposure if anonymity assumptions fail. |
| Recommendation — Protect stored datasets so residual personal data is harder to expose. | ||
| NIST SP 800-53 Rev 5 | PT-2 — Privacy Risk Assessment | Recital 26 requires a structured privacy risk judgment about re-identification likelihood. |
| Recommendation — Perform a privacy risk assessment before claiming data is anonymous. | ||
Practitioner Guidance
What to verify: Test the dataset against realistic re-identification scenarios, including linkage with other records the recipient, attacker, or market participants could plausibly obtain. If a person can still be singled out or re-linked with reasonable effort, do not treat the data as anonymous.
Decision rule: If the data still depends on secrecy about who might combine it with auxiliary information, treat it as personal data and apply GDPR controls. Reserve an anonymity conclusion for cases where identification is no longer reasonably possible under the standard Recital 26 describes.
Practitioner takeaway: Recital 26 is about defensible anonymity, not just stripped identifiers, so the safest operational stance is to assume data remains personal until you can justify why re-identification is no longer reasonably likely.