GDPR Art. 5(2): accountability for a model anonymity claim
A controller that claims a trained model holds no personal data must be able to demonstrate it; the EDPB sets an anonymity test and the evidence it expects
AIGE-OBL-GDPR-ART5-2. Drawn from chapter 08.
Text alternative
- Clause: GDPR, Art. 5.
- Duty holder: Controller.
- Applies from: 2018-05-25, In force.
- Artefact: Anonymity evidence pack.
- Layers: Layer 03, Layer 05.
- Evidence record: Evidence record v1.
- Record schema: Evidence record.
- The same topic in 19 other frameworks; the crosswalk section below links each clause.
Data table: the dates
| Date | Step | Detail |
|---|---|---|
| 2018-05-25 | In force |
- Id
AIGE-OBL-GDPR-ART5-2- Instrument
- General Data Protection Regulation (EU) 2016/679 law
- Clause
- Art. 5(2)
- In scope
- Controller (model developer)
- Authority
- National data protection authority
- Applies from
- In force
The artefact that evidences it
Anonymity evidence pack; membership-inference and extraction evals in the eval gate.
Data table: every relation
| Family | Item | Relation |
|---|---|---|
| Same crosswalk topic | AI Verify 9.1.1, 9.5.2 | Core clause |
| Same crosswalk topic | CSA AICM GRC-01, GRC-06 | Core clause |
| Same crosswalk topic | China Algo. Rec. AlgoRec Art. 7 | Core clause |
| Same crosswalk topic | China Deep Synthesis DeepSyn Art. 7 | Core clause |
| Same crosswalk topic | China GenAI Measures GenAI Art. 9 | Core clause |
| Same crosswalk topic | EU AI Act Art. 17, Art. 4, Art. 87 | Core clause |
| Same crosswalk topic | GAO AI Accountability 1.2, 1.1, 1.3 | Core clause |
| Same crosswalk topic | ISO 42001 5.1, 5.2, 5.3, A.2, A.3, 9.3, 7.2, 9.2, 10.1 | Core clause |
| Same crosswalk topic | NIST AI RMF GOVERN 1, GOVERN 2, GOVERN 4, GOVERN 5 | Core clause |
| Same crosswalk topic | OECD AI Principles OECD 1.5 | Core clause |
| Same crosswalk topic | Singapore Agentic Agentic 2.2.1 | Core clause |
| Same crosswalk topic | Singapore GenAI GenAI 1 | Core clause |
| Same crosswalk topic | TC260 Framework 3.0 TC260 4, TC260 5.3.12 | Core clause |
| Same crosswalk topic | UK ATRS ATRS 2.1 | Core clause |
| Same crosswalk topic | CoE Convention CoE Art. 9 | Related clause |
| Same crosswalk topic | EN 18286 EN 18286 | Related clause |
| Same crosswalk topic | G7 Code G7 Action 5 | Related clause |
| Same crosswalk topic | GPAI Code Safety C8 | Related clause |
| Same crosswalk topic | Korea AI Act Art. 36 | Related clause |
Patterns that build it
No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Governance and accountability
- EU AI Act Art. 17 Quality management system (core)
- ISO 42001 5.1 Leadership and commitment (core)
- ISO 42001 5.2 AI policy (core)
- ISO 42001 5.3 Roles, responsibilities and authorities (core)
- ISO 42001 A.2 Policies related to AI (core)
- ISO 42001 A.3 Internal organization (core)
- NIST AI RMF GOVERN 1 GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively (core)
- NIST AI RMF GOVERN 2 GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained (core)
- TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
- TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
- China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
- China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
- China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
- ISO 42001 9.3 Management review (core) (clause not verified)
- CSA AICM GRC-01 Governance Program Policy and Procedures (core)
- CSA AICM GRC-06 Governance Responsibility Model (core)
- UK ATRS ATRS 2.1 Owner and responsibility (core)
- Singapore GenAI GenAI 1 Accountability (core)
- Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
- OECD AI Principles OECD 1.5 Accountability (core)
- GAO AI Accountability 1.2 Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system (core)
- AI Verify 9.1.1 Accountability: establish policies on the development and use of AI aligned with other organisational policies (core)
- AI Verify 9.5.2 Accountability: clear internal governance mechanisms and roles, including a cross-departmental AI governance committee (core)
- EU AI Act Art. 4 AI literacy
- EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
- ISO 42001 7.2 Competence (clause not verified)
- ISO 42001 9.2 Internal audit (clause not verified)
- ISO 42001 10.1 Continual improvement (clause not verified)
- NIST AI RMF GOVERN 4 GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk
- NIST AI RMF GOVERN 5 GOVERN 5: Processes are in place for robust engagement with relevant AI actors
- GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
- Korea AI Act Art. 36 Domestic representative
- CoE Convention CoE Art. 9 Accountability and responsibility
- G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
- EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
- GAO AI Accountability 1.1 Clear goals: define clear goals and objectives for the AI system
- GAO AI Accountability 1.3 Values: demonstrate a commitment to values and principles established by the entity
Source
Chapter 08, section The GDPR, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-gdpr-art5-2.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). GDPR Art. 5(2): accountability for a model anonymity claim (AIGE-OBL-GDPR-ART5-2). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-2. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{GDPR Art. 5(2): accountability for a model anonymity claim (AIGE-OBL-GDPR-ART5-2)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art5-2},
note = {Version 0.5.0}
}