The three tests of anonymisation (singling out, linkability, inference), explained
Singling out, linkability, inference: what the three WP29 tests mean, shown on document examples, why pseudonymisation fails them, and where the EDPB stands.
In the EU, regulators test anonymisation with three questions. Can someone single one person out? Link two records about the same person? Infer new facts about them? If the answer is no to all three, the data can safely be treated as anonymous. These tests come from Opinion 05/2014 of the Article 29 Working Party (WP29), the body that came before the European Data Protection Board (EDPB).
The Opinion dates from 10 April 2014. Regulators still quote it, and a July 2026 EDPB draft updates it. Checked as of September 2026.
What are the three tests of anonymisation?
For the Opinion, identifying someone is more than finding a name. It also covers identifiability by singling out, linkability and inference. So a file with no names in it can still be personal data.
| Test | Question | Document example |
|---|---|---|
| Singling out | Can I isolate the lines about one person? | The only night nurse hired in 2021. |
| Linkability | Can I link two records about the same person? | Two redacted letters, same case number. |
| Inference | Can I deduce a fact about a person from other details? | A whole team of four is on sick leave. |
What do the three tests look like in a document?
Singling out means isolating the records that identify one individual. In a fictitious HR summary, the name Jane Example is blacked out. But the text still says: the only female site manager at the Leeds depot, hired in March 2019. One person fits. Rare job titles, exact dates and small places are the usual culprits.
Linkability is the ability to link at least two records about the same person. In documents, a stable detail survives across files. Two redacted letters keep the same case number. A contract and an invoice show the same amount on the same day.
Inference means deducing, with significant probability, the value of one attribute from others. An absence table shows a team of four, all on long-term sick leave. If you know John Example works there, you know something about his health. The Opinion calls this the main flaw of k-anonymity.
Randomisation and generalisation: what are the two families of techniques?
Randomisation alters the truth of the data to break the link between a record and a person. Noise addition makes values less exact: a height measured to the centimetre becomes accurate to plus or minus 10 cm. Permutation shuffles values between records. Differential privacy adds calculated noise to query answers.
Generalisation changes the scale of details: a region rather than a city, a month rather than a week. K-anonymity groups each person with at least k others who share the same values. L-diversity and t-closeness also keep the sensitive values inside each group varied. In a document: a manager in the north of England, not the Leeds depot manager.
| Technique | Singling out? | Linkability? | Inference? |
|---|---|---|---|
| Pseudonymisation | Yes | Yes | Yes |
| Noise addition | Yes | May not | May not |
| Substitution | Yes | Yes | May not |
| Aggregation or k-anonymity | No | Yes | Yes |
| L-diversity | No | Yes | May not |
| Differential privacy | May not | May not | May not |
| Hashing or tokenisation | Yes | Yes | May not |
The Opinion says no technique meets the three criteria with certainty, so it recommends combining them, case by case. Anonymisation is not a one-off exercise either: risks should be reassessed regularly.
Why does pseudonymisation fail the three tests?
Pseudonymisation replaces one attribute, usually a unique one such as a name or a client number, by another: a code or a label like [NAME1]. The Opinion is blunt: pseudonymisation is a useful security measure but not a method of anonymisation. The new label still singles the person out. Records that share it are trivially linked. The real identity can still be inferred from the remaining details.
The GDPR agrees. Recital 26 says pseudonymised data that could be attributed to a person with additional information is information on an identifiable person. Recital 28 adds that pseudonymisation can reduce risks. Useful, but it does not take data outside the GDPR.
What is the status of the EDPB guidelines in 2026?
Anonymisation: the EDPB adopted draft Guidelines 02/2026 on 7 July 2026. Public consultation runs until 30 October 2026. The three tests stay under new names: No Record Isolation, No Linkage, No Inference. If one fails, further analysis is needed before concluding. The draft builds on the Court of Justice ruling EDPS v SRB (C-413/23 P, 4 September 2025): whether data is anonymous may vary from one entity to another.
Pseudonymisation: the EDPB adopted draft Guidelines 01/2025 on 16 January 2025, open for comments until 14 March 2025. The draft says pseudonymised data stays personal data even when someone else holds the additional information. The SRB ruling nuanced this: for the Court, pseudonymised data is not personal data in all cases and for every person. The EDPB then heard stakeholders in December 2025 for its ongoing work. As of September 2026, it still shows only the draft.
What does this mean for your documents?
The Opinion was written for datasets. Its three questions also work on a contract, a medical letter or a CV.
- Mask every direct identifier: names, emails, phone numbers, addresses, ID and account numbers.
- Hunt quasi-identifiers: job title, exact date, small town, rare illness. Ask the singling-out question for each.
- Generalise what you cannot delete: a year instead of a date, a region instead of a town.
- Look for links: case numbers, amounts and dates the reader may find in other files.
- Test inference: could the reader deduce a fact about one person's health or money?
- If a test fails, call the file redacted or pseudonymised, and keep applying the GDPR.
Software helps with step one: it spots emails, IBANs or phone numbers fast, but cannot judge context. ONYRI Sanitize, for example, masks a PDF, a Word file or a scan inside the browser, and you review each item before export. Its Token mode, with labels like [NAME1], is pseudonymisation. Its black bars are irreversible. Neither makes a document anonymous by itself.
Frequently asked questions
Is WP29 Opinion 05/2014 still valid under the GDPR?
It was written under the old Directive 95/46/EC, but its three criteria are still in use. A footnote in the EDPB 2026 draft says a controller who found a dataset anonymous under the 2014 Opinion is not expected to redo the assessment.
Does data have to pass all three tests to be anonymous?
Passing all three is the safe route. If one test fails, the Opinion asks for a thorough evaluation of the identification risks. The CNIL says the controller must then show that the risk of identification is negligible.
Is hashing a name or an ID number anonymisation?
No. The Opinion lists hashing and tokenisation as pseudonymisation techniques. If the possible inputs are known, as with national ID numbers, an attacker can hash every value and compare the results. A salt makes this harder, but finding the original value may still be feasible with reasonable means.
Does anonymisation mean zero risk?
No. Recital 26 of the GDPR looks at the means reasonably likely to be used, counting cost, time and available technology. The Opinion accepts that a residual risk remains. In the UK, the ICO, in guidance now under review, says the risk of identification must be sufficiently remote, and that the law does not require you to consider every hypothetical chance.
Sources & references
- Opinion 05/2014 on Anonymisation Techniques (WP216), adopted 10 April 2014Article 29 Data Protection Working Party
- Guidelines 02/2026 on Anonymisation, version 1.0 for public consultation, adopted 7 July 2026European Data Protection Board
- EDPB sheds light on anonymisation and web scraping for generative AI (news, 8 July 2026)European Data Protection Board
- Guidelines 01/2025 on Pseudonymisation, public consultation pageEuropean Data Protection Board
- Press release No 107/25: judgment in Case C-413/23 P, EDPS v SRB, 4 September 2025Court of Justice of the European Union
- Report on stakeholder event on anonymisation and pseudonymisation of 12 December 2025European Data Protection Board
- Regulation (EU) 2016/679 (GDPR), recitals 26 and 28EUR-Lex
- How do we ensure anonymisation is effective?Information Commissioner's Office (UK)
- L'anonymisation de données personnellesCNIL