Red teaming the EDPB's draft anonymisation guidelines: a workshop

By Shlomi Hod, PhD, published October 8, 2026.

A red-teaming workshop at KIT looked for ways to comply with the EDPB's draft anonymisation guidelines while defeating their purpose.

How do you follow a regulation all the way around it? On 5 October, lawyers and computer scientists met at KIT to put that question to the EDPB's draft anonymisation guidelines.

The European Data Protection Board (EDPB) Guidelines 02/2026 on Anonymisation set out when data counts as anonymous and so falls outside the GDPR. The EDPB has opened them for public consultation until 30 October, inviting the kind of feedback that helps refine the final text.

(We borrowed the red teaming approach from computer security, where defenders attack their own systems before someone else does. Two teams, each combining legal and technical expertise, played the adversary, an organisation that complies with the letter of the guidelines while defeating their spirit, and tried to break a passage by constructing a realistic system that does exactly that.

How the attack works

We abstract a regulation as a line, a normative boundary that separates the computing systems allowed to be deployed from those that are not. For the anonymisation guidelines, the line separates data that counts as anonymous, and so falls outside the GDPR, from personal data. This is of course a simplification, since law is inherently ambiguous and comes with multiple institutions and mechanisms to interpret it. Nonetheless, the abstraction is methodologically useful for uncovering the gap between the boundary the drafters intended and the boundary the text actually draws. The aim of the attack is to surface that gap as concretely as possible, so that the needed change becomes easy to articulate and clearly justified.

The unit of attack is a case study, a concrete deployment of a computing system. Like a test case in software, it cannot prove a rule correct, but it can show where the rule fails. Lawyers and engineers can argue over the same case, which makes it a boundary object between the disciplines.

What we attacked

We deliberately picked two parts of the guidelines to attack. Rather than revisit problems that are already well established, we chose passages whose wording seemed under-specified, leaving room for interpretation in ways we could sense but not yet turn into a concrete vulnerability. Working on a single part each, the teams could unpack these intuitions and test where exactly the text gives way.

The first is the guidelines' relative view of anonymity, under which the same data can be anonymous for a recipient while remaining personal for the organisation that anonymised it (paragraphs 37-39). One team showed that the purpose for which the data was originally collected does not travel with it, so passing anonymised data on can sidestep the limits that this purpose set.

The second is the No Inference criterion, one of the three technical criteria the guidelines use to assess whether data is anonymous (paragraphs 70-71). Inferences that could have been drawn from general knowledge or from information about the population at large do not count as personal. Here the vulnerability lies in who decides what counts as general knowledge. Organisations can shape it, and the text lets them rely on the presumption through their own demonstration (paragraph 71(c)). In our reading, nothing checks that demonstration from the outside. Our submission will propose a patch.

Part of a larger research agenda

The workshop is part of our broader research agenda on Dialectic Policymaking, a toolbox of structured, interactive methods for refining tech regulation by confronting how rules are interpreted across disciplinary and institutional boundaries. The workshop suggested that red teaming of policy drafts works in practice and is mature enough to be experimented with in the policymaking process itself.

We will submit our feedback to the EDPB consultation by 30 October, and we are looking for regulators, data protection authorities and legislative staff who would like to red-team live drafts of tech regulation with us, including on AI and privacy. If that is you, please get in touch.

We thank the participants from the OECD, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, the FZI Research Center for Information Technology and FIZ Leibniz Institute for Information Infrastructure, Karlsruhe.