When is data anonymous rather than just de-identified?
Data is anonymous when the people in it cannot reasonably be identified, taking cost, time and available technology into account; the European Data Protection Board's draft guidelines add that this should be assessed "from each relevant entity’s perspective" (EDPB Guidelines 02/2026). GDPR Recital 26 judges identifiability by "all the means reasonably likely to be used, such as singling out", and says data protection principles should not apply to anonymous information (GDPR Recital 26). The European Data Protection Board published draft Guidelines 02/2026 on anonymisation on 8 July 2026 and opened a public consultation on them (EDPB). In the UK, the ICO says its anonymisation guidance is under review because of changes made by the Data (Use and Access) Act (ICO).
Can SOPs, documents and code be truly anonymised?
Often the parts that carry the value can be, because a procedure, a policy, a troubleshooting step or a function rarely needs to say who wrote it. Free text is harder. A support ticket that mentions an unusual fault, a town and a date may still point to one customer with the name removed, and a commit message or code comment can name a colleague or a client. That is why anonymity is judged across the whole dataset and its context, not by whether the name fields are blank.
What does anonymization mean for what you license and control?
Truly anonymous data falls outside the GDPR, which can make it simpler to license, but calling a dataset anonymous is a legal judgement, so take advice before relying on it. A licence can add a contractual layer: micro1's published data licence terms bar the licensee from knowingly trying to "identify or re-identify any natural person or specific customer" in anonymized or de-identified data (micro1, Data License Master Terms, section 1.4(c)). fearofgod.ai de-identifies the data before it goes to buyers. This page is general information, not legal advice.