European Data Protection Board proposes recipient-specific test for anonymising genomic data

What happened

• The EDPB released draft Guidelines 02/2026 on anonymisation that adopt a recipient‑specific approach.
• Under the draft, genomic data could be considered personal for a hospital that retains the key but anonymous for a research institute that receives de‑identified sequences.
• This distinction determines whether GDPR obligations such as legal basis identification and breach notification apply.
• The guidance also impacts data‑sharing agreements and the use of health data repositories under the European Health Data Space.

Why it matters

Entities exchanging genomic data must assess anonymity based on the recipient's likely means of re‑identification, which can trigger GDPR compliance requirements for the receiving party.

Business impact

Hospitals may need to retain identifiers and treat shared genomes as personal data, while research institutes must evaluate their processing to determine GDPR scope.

What to check

1. 1

   Review data‑sharing agreementsHigh priority

   Ensure contracts reflect whether shared genomic data is treated as personal or anonymous under the recipient‑specific test.

2. 2

   Conduct recipient‑specific anonymity assessmentHigh priority

   Evaluate the likelihood that each recipient could re‑identify individuals from the genomic dataset.

3. 3

   Determine GDPR applicabilityMedium priority

   If data is deemed personal for the recipient, identify a legal basis and implement breach‑notification procedures.