Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Regulation July 24, 2026 3 min

EDPB adopts guidelines on anonymisation, web scraping for generative AI, and blockchain

At its July plenary the European Board addresses three knots the DPO meets every week, and which until now were handled by instinct

TL;DR for the DPO

Three topics previously handled by instinct now have a common European reference: anonymisation (when data truly falls outside the GDPR), web scraping for generative AI (on what conditions you may collect from the web for training), blockchain (immutability versus the right to erasure).

The three points that matter

  • Anonymisation: it is the distinction that decides whether the GDPR applies at all, and it is claimed far more often than it is actually achieved. In practice it is almost always pseudonymisation, which remains fully subject to the Regulation.
  • Web scraping for generative AI: the question every client asks who wants to train or feed a model. It intertwines with legitimate interest and with the Art. 14 notice, where data does not come from the data subject.
  • Blockchain: the difficulty is structural, because the immutability of the chain conflicts with the right to erasure. The guidelines arrive in final form, so they become the benchmark against which to measure projects already under way.

What to do now, in practice

1) Inventory the claims of anonymity in your clients' documentation - register, notices, DPIAs - and check which actually hold: it is the item most often overstated; 2) if a client collects web data to feed AI systems, set up the legitimate interest assessment and the Art. 14 notice straight away; 3) read the guidelines before the client does: arriving prepared for these questions is exactly what separates a consulting DPO from a formal one.

Why it matters for your clients

These are the three topics on which, over the past two years, most decisions were taken without a clear reference. Common guidelines mean choices made so far can be reviewed and aligned, but also that it becomes harder to defend a position taken by instinct. It is worth reopening the files where anonymity or scraping had been taken for granted.

Official source:European Data Protection Board (EDPB) - July 2026 plenary: guidelines on anonymisation, on web scraping in the context of generative AI, and on processing through blockchain technologies

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min