Since the entry into force of Regulation (EU) 2016\/679, the General Data Protection Regulation (GDPR), and Organic Law 3\/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD), the processing of personal data must be carried out under the principles of proactive responsibility and a risk-based approach.<\/p>\n
In this context, anonymisation has become a key tool to minimise the risks derived from the processing of personal information<\/strong> and to enable its subsequent use (for example, for statistical, research, or analytical purposes) without compromising individuals\u2019 rights.<\/p>\n The Spanish Data Protection Agency (AEPD) published its guidance ‘Orientations and Safeguards in Data Anonymisation Processes’, which provides technical and legal criteria on how to properly anonymise data and assess the risk of re-identification.<\/p>\n The AEPD reminds that absolute anonymisation does not exist: the possibility of re-identification depends on context, available data sets, and technological developments. In practice, data will be considered anonymised insofar as there is no reasonable likelihood that any person could identify the data subject within the data set<\/strong>.<\/p>\n Therefore, every anonymisation process must be based on the following principles:<\/p>\n <\/p>\n Furthermore, the GDPR requires the incorporation of anonymisation or pseudonymisation ‘by design and by default’ (Article 25 GDPR).<\/p>\n According to current AEPD guidance, the recommended phases for a responsible anonymisation process are:<\/p>\n The controller must define the purpose of the data to be anonymised and determine whether that purpose can be achieved using anonymised data.<\/p>\n It is advisable to document this decision and consider alternatives such as pseudonymisation or data aggregation.<\/p>\n A detailed analysis should identify:<\/p>\n <\/p>\n In certain cases, a Data Protection Impact Assessment (DPIA) may be required pursuant to Article 35 GDPR.<\/p>\n Among the anonymisation techniques most commonly used and recommended by the AEPD and the European Data Protection Board (EDPB) are:<\/p>\n <\/p>\n Using combined techniques increases the robustness of the process.<\/p>\n The effectiveness of the anonymisation must be tested, for instance, through:<\/p>\n The process, decisions taken, and results should all be properly documented.<\/p>\n It is also recommended to establish internal anonymisation policies and periodic reviews to ensure that the data remain anonymised over time.<\/p>\n The AEPD recommends implementing the following additional measures to strengthen data protection:<\/p>\n <\/p>\n Anonymisation has become an essential component of regulatory compliance and of privacy-by-design and by-default strategies. However, it should be understood as a continuous technical and legal process, not as a single or definitive action<\/strong>.<\/p>\n Adopting a rigorous and well-documented approach, consistent with the guidance of the AEPD and the GDPR, enables organisations to minimise risks, facilitate lawful data reuse, and safeguard individuals\u2019 rights.<\/p>\n <\/p> Data anonymisation methods<\/h2>\n
\n
In which cases is it necessary to anonymise personal data<\/h2>\n
a) Planning and definition of objectives<\/h3>\n
b) Analysis and assessment of re-identification risks<\/h3>\n
\n
c) Selection and application of appropriate techniques<\/h3>\n
\n
d) Validation and verification of results<\/h3>\n
\n
e) Documentation and maintenance<\/h3>\n
Techniques recommended by the AEPD<\/h2>\n
\n
Contact Us<\/h2>\n
<\/ul><\/div>\n