TL;DR for the DPO
Three topics previously handled by instinct now have a common European reference: anonymisation (when data truly falls outside the GDPR), web scraping for generative AI (on what conditions you may collect from the web for training), blockchain (immutability versus the right to erasure).
The three points that matter
- Anonymisation: it is the distinction that decides whether the GDPR applies at all, and it is claimed far more often than it is actually achieved. In practice it is almost always pseudonymisation, which remains fully subject to the Regulation.
- Web scraping for generative AI: the question every client asks who wants to train or feed a model. It intertwines with legitimate interest and with the Art. 14 notice, where data does not come from the data subject.
- Blockchain: the difficulty is structural, because the immutability of the chain conflicts with the right to erasure. The guidelines arrive in final form, so they become the benchmark against which to measure projects already under way.
What to do now, in practice
1) Inventory the claims of anonymity in your clients' documentation - register, notices, DPIAs - and check which actually hold: it is the item most often overstated; 2) if a client collects web data to feed AI systems, set up the legitimate interest assessment and the Art. 14 notice straight away; 3) read the guidelines before the client does: arriving prepared for these questions is exactly what separates a consulting DPO from a formal one.
Why it matters for your clients
These are the three topics on which, over the past two years, most decisions were taken without a clear reference. Common guidelines mean choices made so far can be reviewed and aligned, but also that it becomes harder to defend a position taken by instinct. It is worth reopening the files where anonymity or scraping had been taken for granted.
Official source:European Data Protection Board (EDPB) - July 2026 plenary: guidelines on anonymisation, on web scraping in the context of generative AI, and on processing through blockchain technologiesLooking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
