Glossary · Glossary · GDPR concepts
GDPR Recital 26: where personal data ends and anonymous data begins
Anonimatum Team
In short
Recital 26 of the GDPR explains how to decide whether a person is identifiable: by considering all means reasonably likely to be used to identify them. If they are not identifiable, the information is anonymous and the GDPR does not apply.
Few sentences in the GDPR carry as much practical weight as Recital 26. It decides whether a document stripped of names is still regulated or has left the scope of the law. Recitals are not freestanding rules, but they guide how the articles are read, and the Court of Justice relies on them constantly.
This entry covers what Recital 26 says, how courts have applied it, how the UK approaches the same question and what it means when you are protecting a PDF, a contract or a decision rather than a database.
What Recital 26 says
The text links four ideas:
- Data protection principles apply to any information concerning an identified or identifiable natural person.
- Pseudonymised data that could be attributed to a person using additional information is information on an identifiable person.
- To decide whether someone is identifiable, account should be taken of all means reasonably likely to be used, such as singling out, by the controller or by another person, to identify them directly or indirectly.
- The principles do not apply to anonymous information or to data rendered anonymous, including for statistical or research purposes.
It mirrors the definition of personal data in Article 4(1), marking where personal data ends and anonymous information begins.
The objective factors: cost, time and technology
To judge which means are reasonably likely, the recital points to objective factors. The table applies them to a fictitious document.
| Factor | Practical question | Fictitious example |
|---|---|---|
| Cost | How expensive would identification be? | Checking a free public register costs nothing |
| Time | How much effort would it take? | A five-minute web search |
| Available technology | What tools exist today? | Copying text hidden under a visual black box |
| Technological developments | What will be possible tomorrow? | OCR or AI that reads handwriting and stamps |
| Who might try | The controller or anyone else? | A neighbour who knows the events described |
What the courts have said: Breyer and SRB
In Breyer (C-582/14, 19 October 2016), the Court of Justice held that a dynamic IP address can be personal data for a website operator that has legal means to identify the user with additional information held by the internet service provider. The information does not have to sit with one organisation; it is enough that obtaining it is a means reasonably likely to be used.
In Case C-413/23 P (EDPS v SRB, 4 September 2025), the Court added that identifiability is assessed from each entity’s perspective. Pseudonymised data may not be personal for a recipient with no reasonable means of re-identification, while it remains personal for whoever pseudonymised it. The EDPB’s Guidelines 02/2026 on anonymisation, open for consultation until 30 October 2026, build on that reasoning.
The UK perspective
The UK GDPR and the Data Protection Act 2018 keep the same core definition: personal data relates to an identified or identifiable living individual, directly or indirectly. ICO guidance applies the same reasonableness logic and adds the “motivated intruder” test. The Data (Use and Access) Act 2025 amended the UK framework, and the ICO has said its anonymisation guidance is under review as a result, so check the latest version before relying on it.
What it means for documents
In a document the question is not only whether the name appears, but whether the whole text reveals who it is about. A fictitious decision about “the only pharmacist in a village of 300 people” identifies someone even with the name removed. Indirect identifiers such as job titles, dates, places, number plates and case references matter, and so do file metadata.
The audience matters too: sharing internally is not the same as publishing online, where anyone can cross-check other sources. Redaction must also be real. If the text survives under a black box, it can be recovered with trivial means and there is no anonymisation. Anonimatum detects direct and indirect identifiers with its own AI on EU servers, lets you review them and removes text and metadata from the output; see GDPR document anonymisation.
Frequently asked questions
Is Recital 26 legally binding?
Recitals do not create obligations on their own, but they are used to interpret the GDPR’s articles and the Court of Justice relies on them routinely.
Does Recital 26 require zero risk?
No. Identification must not be reasonably likely given cost, time and available technology. Residual re-identification risk should be remote.
Does it apply to deceased people?
The GDPR does not apply to the personal data of deceased persons (Recital 27), and the UK regime likewise covers living individuals only.
Is removing names enough to satisfy Recital 26?
Rarely. Context, indirect identifiers and metadata often still point to the person.
Make your documents genuinely anonymous
See the plans and start finding direct and indirect identifiers in PDF, Word and Excel files, with human review before anything is removed.