EDPB Opinion 28/2024, para 101: masking and substituting personal data (EDPB Opinion 28/2024, adopted 17 December 2024, para 101(c))
Replacing names and email addresses with fake ones is the first mitigation the EDPB lists for training data. It fits support tickets and chat, where the wording matters to a buyer but the identities do not.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Measures to mask personal data or to substitute it with fake personal data in the training set ... This measure may be particularly appropriate when the actual substantive content of the data is not relevant to the overall processing (e.g. in LLM training).”
Where it was read
Also read from the same source
- EDPB Opinion 28/2024, para 66: the legitimate interest test must be assessed and documented (EDPB Opinion 28/2024, adopted 17 December 2024, para 66)
- EDPB Opinion 28/2024, para 92: a privacy notice is not enough to create expectations (EDPB Opinion 28/2024, adopted 17 December 2024, para 92)
- EDPB Opinion 28/2024, para 102: a waiting period and an unconditional opt-out (EDPB Opinion 28/2024, adopted 17 December 2024, para 102(a)-(b))
- EDPB Opinion 28/2024, para 114: corrective measures can reach the whole dataset (EDPB Opinion 28/2024, adopted 17 December 2024, para 114)
- EDPB Opinion 28/2024, para 129: the next party must check where the data came from (EDPB Opinion 28/2024, adopted 17 December 2024, para 129)
- EDPB Opinion 28/2024, para 134: a claim of anonymity must be shown (EDPB Opinion 28/2024, adopted 17 December 2024, para 134)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide