An AI supplier describes its data as anonymous. Before making a decision, ask for a scoped explanation: which dataset does the claim cover, for which recipient and which use? A sales statement is not enough to close your own privacy review.
Status on 13 September 2026: in July, the EDPB published new guidelines on anonymisation and web scraping for generative AI. Both are consultation versions, with comments open until 30 October 2026. They should not be presented as final new legislation.1
What does anonymous mean in this review?
The draft guidance considers the relevant recipient and its ability to distinguish an individual. Its proposed framework examines record isolation, linkage and inference. Failing a criterion calls for further analysis rather than an automatic final conclusion.2
Our practical recommendation: request the assessment behind the claim, including the data version and assumptions examined. Ask a technical specialist to explain the testing approach and legal counsel to assess whether the conclusion fits your intended use.
What if the training data came from the internet?
The separate draft guidance addresses web scraping by private entities for generative AI. GDPR remains relevant when personal data is processed. The guidance covers legal basis, transparency and limits on collection, among other matters.3
First establish whether the supplier collects data itself or uses an existing dataset. A general reference to public sources does not answer your specific procurement questions.
Five questions for the supplier meeting
This is our suggested review agenda, not an official EDPB checklist:
-
Which data does the claim actually cover? A version-specific description with explicit exclusions.
-
Who performed the assessment? A name or role, date and explanation of the approach.
-
What is still missing from the file? Open questions with an identified contact.
-
What happens when the model or dataset changes? An agreed point to revisit changed assumptions.
-
Who makes our internal decision? An owner who records advice, remaining uncertainty and next steps.
Example: a customer service assistant
Suppose a supplier offers a customer service assistant. Its statement about anonymous training data does not explain what your employees will later enter into the application. Request two separate descriptions: the evidence supporting the training-data claim and the arrangements for your own use. This prevents one answer from closing two different reviews. This is a fictional example, not a client case.
Turn this into a focused assignment
Gather the supplier statement, available documentation and your intended use. Then identify the decision for which you need advice. Embed AI can support a privacy and contract review or a standalone privacy assessment.
For a broader overview, read privacy and GDPR in practice. To identify initial priorities, use the free privacy and AI scan.
Are these EDPB guidelines final?
No. The versions discussed are open for consultation on the publication date. Check whether a final version is available when conducting a later review.
Does this checklist replace a privacy assessment?
No. These questions help prepare a supplier discussion. The conclusion depends on the actual data, parties and application.
Sources
1. EDPB announcement, 8 July 2026: anonymisation and web scraping — European Data Protection Board.
2. Guidelines 02/2026 on Anonymisation, version 1.0 for public consultation — European Data Protection Board.
3. Guidelines 03/2026 on web scraping in the context of generative AI, version 1.0 for public consultation — European Data Protection Board.
