Introduction#
The European Data Protection Board has three sets of draft guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. out for comment. Comments on anonymisation and on web scraping close at 23:59 CET on 30 October 2026. Comments on when to impose a fine close at 23:59 CET on 13 November 2026. All three are drafts, not final guidance.
How it got here#
7 July 2026. The EDPB adopted GuidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. 02/2026 on anonymisation and Guidelines 03/2026 on web scraping for generative AI, both for public consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules..
17 September 2026. It adopted GuidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. 04/2026 on when a supervisory authority should impose a fine, for public consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules..
What each draft says#
Anonymisation (02/2026). Data is anonymous when it does not relate to an identified or identifiable person. The EDPB says each relevant entity should judge anonymity from its own point of view, taking account of the means reasonably likely to be used. A firm can apply the test in a “contextual” way or a “simplified” way. It has three criteria: no record isolation, no linkage and no inference. If data meets all three, the EDPB states a firm can safely treat it as anonymous. If it fails any, the firm needs more analysis.
Who it touches: firms that anonymise customer, transaction or case data for analytics, sharing or retention.
Web scraping (03/2026). The draft covers private entities that scrape personal data from the internet, themselves or through a contractor, to train generative AI. The GDPR applies where scraping processes personal data. Controller and processor roles must be analysed case by case. To keep collection to a minimum, the EDPB suggests:
- considering synthetic data;
- setting precise collection criteria;
- filtering out some categories of data;
- excluding websites that hold such data or clearly object to scraping.
It also sets out the three conditions, all of which must be met, for relying on legitimate interest under Article 6(1)(f) GDPR.
Who it touches: firms that use scraped open-source data to build screening, adverse-media or fraud models.
When to fine (04/2026). The draft sets a five-step method for deciding whether to fine, as well as or instead of other corrective measures under Article 58(2) GDPR:
- Can the infringement lead to a fine?
- Can this party be fined for it?
- Was it committed intentionally or negligently?
- Do the Article 83(2) factors make it minor? If so, as a rule, no fine. If not, the EDPB states there is a strong presumption of a fine.
- Would a fine be effective, proportionate and dissuasive under Article 83(1)?
The draft adds to the EDPB's earlier guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. on calculating fines.
What comes next#
Short term (to January 2027)
- 30 October 2026, 23:59 CET. Comments close on anonymisation and web scraping.
- 13 November 2026, 23:59 CET. Comments close on when to fine.
No date yet
- Final versions of all three guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law..
Open questions#
- Will the final anonymisation guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. keep the three criteria and the two ways of applying them?
- Will the final fines guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. keep the strong presumption of a fine once an infringement is not minor?
What this is not#
- None of the three is final guidance. Each is a consultationThe stage where a draft law or rule is published for comment before it is adopted — the one moment arguments can still shape the text. National systems name it differently; Swiss practice says Vernehmlassung for statutes, Anhörung for regulators' rules. draft.
- The fines guidelinesA supervisory authority's published position on how rules should be applied. EU guidelines bind authorities on a comply-or-explain basis — they are not themselves the law. do not set how much to fine. They decide whether to fine, alongside the earlier guidelines on calculation.
Reading#
Primary
- Guidelines 02/2026 on anonymisation, version for consultation, EDPB, 7 July 2026
- Guidelines 03/2026 on web scraping for generative AI, version for consultation, EDPB, 7 July 2026
- Guidelines 04/2026 on imposing administrative fines, version for consultation, EDPB, 17 September 2026
Official