Skip to main content

General Data Protection Regulation (GDPR)

Jump straight to Avatar compliance regarding GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union to protect individuals' personal data. It applies to all organizations that process personal data of EU residents, regardless of where the organization is based.

What is Personal Data?​

According to the GDPR, personal data refers to:

“Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”

Examples: Name, email, phone number, IP address, financial information, health records.

Under Article 6 of the GDPR, processing personal data is only lawful if it meets one of the following conditions:

  • Consent: The individual has given explicit consent.
  • Contractual necessity: Processing is necessary for contract performance.
  • Legal obligation: Compliance with legal requirements.
  • Vital interests: Processing is required to protect life or health.
  • Public interest: Processing is necessary for tasks carried out in the public interest.
  • Legitimate interests: The organization has a legitimate reason, provided it does not override the individual's rights.

Pseudonymization vs. Anonymization​

  • Pseudonymization: Data is modified so that it cannot be attributed to a person without additional information. However, pseudonymized data is still considered personal data under GDPR.
  • Anonymization: Data is altered so that it is irreversibly unidentifiable. Anonymized data is no longer subject to GDPR.

See our blog article for more details →

Processing of Sensitive Data​

Article 9 of the GDPR defines sensitive data as information relating to race, religion, political opinions, genetics, biometrics, health, or sexual orientation. Processing such data is generally prohibited, except under specific conditions:

  • Explicit consent
  • Medical or scientific research
  • Public health reasons
  • Legal claims

Anonymization Process Status​

The European Data Protection Board (EDPB), formerly known as Working Party 29 (WP29), considers that:

"The anonymization process, which involves processing personal data to render it anonymous, constitutes further processing."

This interpretation highlights that anonymization is not an initial data processing activity but rather an additional transformation applied to personal data.

Draft guidelines

The EDPB Guidelines 02/2026 on anonymisation are a draft under public consultation until 30 October 2026. They are not final and may change before their final adoption. The points below that refer to them describe the draft.

The EDPB's draft Guidelines 02/2026 on anonymisation reinforce a more precise reading: the central question is not whether a transformation has been applied, but whether the resulting dataset remains identifiable in the relevant context, taking into account:

  • the nature and sensitivity of the data,
  • the likely attackers and their means,
  • the context of use and data-sharing environment,
  • and the residual risk of re-identification after technical and organizational safeguards.

This is a contextual and risk-based assessment, not a simple yes/no test.

A crucial point of the draft guidelines is that a criterion does not need to be “100% protected” in an absolute sense for the dataset to be considered sufficiently anonymous in context. The question is not whether a metric is perfect, but whether the residual re-identification risk remains low enough for the actual use case, taking into account the attacker model, available external knowledge, and the safeguards applied.

Similarly, a weak result on one criterion does not automatically mean that the data is not anonymous. A single metric may indicate a higher risk in a specific attack scenario, but the conclusion must be made in context: whether the scenario is realistic, whether attacker capabilities and background knowledge are credible, and whether additional safeguards reduce the residual risk to an acceptable level.

The draft guidelines also clarify that the inference criterion is not a vague or abstract concept. It refers to the realistic ability to infer information about an individual or a small group using available external information, probabilistic reasoning, and modern analytical methods. It is therefore assessed through realistic attack models rather than hypothetical impossibilities.

In the draft EDPB guidelines, the assessment of anonymisation is typically framed through two complementary approaches:

  • Simplified approach: a conservative, worst-case evaluation used when the data is exposed to a broad, external, or poorly controlled audience. It is the appropriate reference point for strict-sharing scenarios such as open data or broad dissemination, where the controller reasonably assumes a motivated attacker with access to external information.
  • Contextual approach: a case-specific evaluation tailored to the actual recipient, purpose, data sensitivity, available background knowledge, safeguards, and environment of use. This is the more precise approach when the dataset is shared under controlled access conditions, with a known recipient and a defined purpose.

The two approaches are not contradictory: the simplified one provides a robust fallback for high-risk distribution, while the contextual one allows a more nuanced assessment when the real conditions of use are known and controlled.

Under Article 5 of the GDPR (link), personal data cannot be processed for purposes incompatible with those initially intended.

In other words, any new processing purpose must be compatible with the original purpose communicated to the data subjects at the time of collection. If deemed compatible, further processing is permissible under GDPR regulations.

Reasonable Means and the Attack Model​

Recital 26 of the GDPR defines anonymous data as data where the person is not or no longer identifiable, taking into account all the means reasonably likely to be used, considering cost, time, and the technological means available at the time of processing.

This is a key point: the standard is not “all imaginable means in the abstract”, nor is it a requirement for absolute theoretical impossibility. It is a reasonable attack model test.

The EDPB's draft guidance on anonymisation is directly relevant here: see the section on the means "reasonably likely to be used" in the EDPB Guidelines 02/2026 on anonymisation (draft, public consultation until 30 October 2026).

In practice, the question is therefore:

  • who is the likely attacker?
  • what external information is reasonably accessible?
  • what linkage possibilities exist?
  • what is the cost and time required to exploit them?
  • what tools and methods are available to a motivated actor?

This means that a dataset can be considered anonymous in a controlled, purpose-limited environment even if a different, broader, more open distribution model would require a stricter assessment. The assessment is therefore contextual and depends on the actual use case and safeguards.

This is also why the concept of reasonable means should be treated as a full dimension of the legal assessment, not as a side remark. It is central to the evaluation of singling out, linkability, and inference.

For a practical checklist on how this is assessed in real-world use cases, see How do we assess whether a means is reasonable?.

The concept of “personal data” as defined in Article 4(1) of the GDPR is not unlimited: it requires that the data subject be identified or identifiable. The Court of Justice of the European Union (CJEU) reaffirmed this principle (SRB v. EDPS, September 4, 2025), confirming that identifiability remains the central criterion for qualification.

Recital 26 of the GDPR specifies that information is considered anonymous where “the data subject is not or no longer identifiable,” taking into account all the means reasonably likely to be used, considering cost, time required, and the technological means available at the time of processing.

This is the key update in the draft guidelines: data are not considered anonymous simply because an anonymization step was applied. They are considered anonymous only when the residual risk of re-identification remains sufficiently low in the actual context of use.

The legal test therefore focuses on reasonable means in context, not on whether the data is impossible to attack under any conceivable circumstance. This is why the assessment must be grounded in a realistic attacker model, a documented risk analysis, and the actual conditions of sharing.

Therefore, the status of data as anonymous depends on:

  • the nature of the data,
  • their level of sensitivity,
  • the context of use,
  • and the realistic attack scenarios that could be used against them.

An anonymization process must therefore be assessed and documented to demonstrate that the residual risk of re-identification remains reasonable in light of the context and purposes.

The technical assessment of risk should take into account the three criteria defined by the EDPB:

  • Singling out: the possibility of isolating a single individual within a dataset,
  • Linkability: the possibility of linking records or datasets concerning the same individual,
  • Inference: the possibility of deducing new, sensitive information about an individual.

In addition, a PIA (Privacy Impact Assessment) must be carried out to evaluate the likelihood of potential attacks against the anonymization process, as well as their impact if successful. In simple terms, the technical report evaluates the residual re-identification risk posed by certain threats, while the PIA measures the probability and severity of those threats in the given context.

Where residual risk is considered too high, additional technical and organizational safeguards can be implemented to further strengthen the anonymization process. These may include controlled access, encryption, time-limited access, data minimization, or filtering of high-risk variables.

When all these criteria are satisfied for the intended use case, the resulting data can be considered outside the scope of the GDPR.

The synthetic data generated using the Avatar method is no longer considered personal data and therefore fall outside the scope of the GDPR. Here's why:

The EDPB (formerly WP29) acknowledges that anonymization, as further processing of personal data, can be considered compatible with the original processing purpose. However, this is contingent on the anonymization process meeting the criteria outlined in Opinion 05/2014 (link).

The anonymization method developed by Octopize has been awarded a CNIL compliance certificate, confirming its classification as an authentic anonymization technique.

Furthermore, anonymization enhances data security by making identification irreversible. Therefore, it is categorized as a technical and organizational security measure, not a substantial modification of data processing.

  • Anonymization of personal health data can be considered a compatible processing activity aligned with the original purposes of data collection.
  • Anonymization does not constitute a substantial modification of data processing under GDPR.
  • No additional notification or consent from data subjects is required when implementing anonymization.
  • Avatarized data resulting from this anonymization process is no longer classified as personal data and thus falls outside the scope of the GDPR.

The data generated using the Avatar Method are not considered anonymous by default. Their anonymity is systematically and automatically evaluated and documented through a rigorous process involving:

  • A technical report measuring the residual re-identification risk based on EDPB criteria (Singling out, Linkability, Inference) and metrics simulating state-of-the-art attack scenarios.
  • A Privacy Impact Assessment (PIA) evaluating the likelihood and severity of these attacks based on data sensitivity and usage context.