Anonymous data under the GDPR: the EDPB's three tests and a EUR 7 million fine
EDPB Guidelines 02/2026 set three tests for anonymous data. Italy's Garante fined IQVIA EUR 7 million over health data it called anonymous.
Calling a dataset "anonymous" takes it outside the GDPR only if it really is. On 7 July 2026 the European Data Protection Board (EDPB) adopted Guidelines 02/2026 on Anonymisation for consultation, which closed on 30 October 2026. On 23 September 2026 the Italian Garante showed what happens when the claim does not hold: a EUR 7 million fine for IQVIA Solutions Italy.
The EDPB's three tests
Data are anonymous for an entity if they do not relate to an identified or identifiable person, using the means reasonably likely to be used. This is assessed from the perspective of each relevant entity, so the same data can be anonymous for one party and personal for another. The data are safely anonymous when all three criteria are met:
- No record isolation: no unique combination of values that belongs to one person.
- No linkage: no record that can be linked to a record about the same person in another dataset.
- No inference: no specific and meaningful conclusion about a person can be drawn.
If one criterion fails, further analysis is needed. The guidelines also say that if the data are personal for a controller, they are personal for its processor too, and that a re-identification technique a partner could simply hire a third party to perform counts as a means reasonably likely to be used.
The IQVIA decision
IQVIA held a database with the health data of about one million patients of 800 general practitioners, used for studies also commissioned by pharmaceutical companies. The Garante found the data were not anonymous: a persistent code per patient allowed tracking over time and, with year of birth, sex, diagnoses, prescriptions and location data, made it possible to single out and re-identify patients.
IQVIA processed health data without a proper legal basis, without informing patients, without retention periods (the data went back to 2001), without a DPIA and without adequate security. If it wants to continue, it must comply within 120 days.
What to do now
List the datasets you treat as anonymous and test them against the three criteria. Where they fail, treat them as personal data: a legal basis, an entry in your record of processing and, for health data at scale, a DPIA.
Dazr Compliance keeps the Article 30 record with the legal basis and Article 9 condition for each activity, screens each activity against the nine EDPB criteria for a DPIA, and holds the DPIAs with their risks, measures and approval.
Sources
- EDPB: Guidelines 02/2026 on Anonymisation, version 1.0 (adopted 7 July 2026)
- EDPB: public consultation on Guidelines 02/2026 on Anonymisation, 8 July to 30 October 2026, and Guidelines at a Glance (October 2026)
- Garante per la protezione dei dati personali: Dati sanitari, 7 milioni di euro di sanzione (2 October 2026)
- EDPB: Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients' health data (9 October 2026)
For information only, not legal advice. Last updated 7 November 2026.
Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål