Topic starter
18/08/2026 2:40 pm
TL;DR: The CJEU has clarified that pseudonymized data is not automatically outside GDPR scope, because identifiability depends on the specific recipient’s realistic ability to re-identify individuals, according to Securiti’s analysis of EDPS v SRB. That makes data-sharing assessments, transparency notices, and recipient-specific risk evaluation central to privacy governance.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “When Does Pseudonymized Data Constitute Personal Data Under GDPR?”.
By the numbers:
- The case involved the SRB's 2017 decision regarding the resolution of Banco Popular Español.
- On December 19, 2025, the parties withdrew the matter from the General Court.
- The EDPB adopted its first comprehensive Pseudonymization Guidelines in January 2025.
Key questions
Q: How should organisations assess whether pseudonymized data is still personal data under GDPR?
A: Start by asking who will receive the data, what other information they already hold, and whether they can realistically re-identify the person using means reasonably likely to be available.
Q: Why do privacy notices still matter after data is pseudonymized?
A: Because transparency obligations arise when the controller collects the data, not only after it has been masked.
Q: What are the biggest mistakes teams make with pseudonymized data?
A: The most common mistake is treating pseudonymization as a blanket exemption from GDPR.
Practitioner guidance
- Build recipient-specific re-identification assessments For each downstream recipient, document what auxiliary data they hold, what technical means they have, and why re-identification is or is not reasonably likely.
- Update privacy notices at collection time Disclose third-party recipients and processing purposes when personal data is first collected, rather than waiting until after pseudonymization or transfer.
- Maintain a pseudonymization decision record Keep the rationale for whether a dataset remains personal data for each recipient, including the assumptions used and the review date.
Bottom line: Pseudonymization reduces direct exposure, but it does not automatically remove GDPR obligations when the recipient can still re-identify people.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:24 pm
Pseudonymization is now a recipient-governed control, not a category label. The CJEU's relativity approach means data protection teams cannot rely on a single technical masking step to settle GDPR scope. The operative question is who receives the data, what else they know, and whether re-identification is reasonably likely. For practitioners, that shifts pseudonymization from a static privacy technique into an access and context governance problem.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations decide whether to share pseudonymized data with third parties?
A: They should assess who the recipient is, what other data they hold, whether the recipient can reasonably re-identify people, and whether the share can be justified and documented. If the answer depends on hidden assumptions about the recipient's environment, the share is not ready for approval. Governance should be tied to the actual recipient, not the label on the dataset.
👉 Read our full editorial: When pseudonymized data still counts as personal data under GDPR