In order to protect individuals' privacy, governments and institutions impose some obligations on data sharing and publishing. Mainly, they require the data to be " anonymized ". In this paper, we shortly discuss the criteria introduced by European General Data Protection Regulation to assess anonymized data. We argue that the evaluation of anonymized data should be based on whether the data allows individual based inferences, instead of being centered around the concept of re-identification as the regulation has proposed. We then propose a framework that allows us to evaluate a given (anonymized) dataset. Finally, we apply our framework to evaluate two real datasets after being anonymized using k-anonymity and l-diversity techniques.