It's all 'relative': Genomic data and the EDPB's draft anonymization guidelines

What happened

The EDPB released draft Guidelines 02/2026 on anonymisation that adopt a recipient‑specific approach. Under the draft, genomic data could be considered personal for a hospital that retains the key but anonymous for a research institute that receives de‑identified sequences. This distinction determines whether GDPR obligations such as legal basis identification and breach notification apply. The guidance also impacts data‑sharing agreements and the use of health data repositories under the European Health Data Space.

Why it matters

Entities exchanging genomic data must assess anonymity based on the recipient's likely means of re‑identification, which can trigger GDPR compliance requirements for the receiving party.

Business impact

Hospitals may need to retain identifiers and treat shared genomes as personal data, while research institutes must evaluate their processing to determine GDPR scope.

Checklist

• Review data‑sharing agreementsHigh priority

  Ensure contracts reflect whether shared genomic data is treated as personal or anonymous under the recipient‑specific test.

• Conduct recipient‑specific anonymity assessmentHigh priority

  Evaluate the likelihood that each recipient could re‑identify individuals from the genomic dataset.

• Determine GDPR applicabilityMedium priority

  If data is deemed personal for the recipient, identify a legal basis and implement breach‑notification procedures.

Who reported it

Discussion