Unpacking the EDPB Pseudonymisation Guidelines: Key insights and learnings

On 16 January 2025, the European Data Protection Board (EDPB) adopted the Guidelines 01/2025 on Pseudonymisation (Guidelines) aiming to clarify the requirements and benefits around the use of pseudonymisation under the General Data Protection Regulation (GDPR).  They are also intended to provide some legal certainty around the definition of pseudonymisation and introduce some new concepts related to it. The document is open for public consultation until February 28, 2025, inviting stakeholders to provide their feedback. 

Pseudonymisation helps organisations protect personal data, reducing the risk of personal data breaches and assists in meeting GDPR compliance requirements. This article provides an overview of the key points of the Guidelines and help organisations understand how they can leverage effective pseudonymisation to streamline their compliance with the GDPR. 

Clarifications on definitions and introduction of a new key concept 

In simple terms, pseudonymisation is a method used by organisations to enhance data privacy by obscuring personal details, making it harder to link it back to individuals. In principle, it works by replacing personal data with information that does not directly identify a specific individual.  

The EDPB dismantles the GDPR definition as outlined in article 4(5) of the GDPR and clarifies that the attribution of data to an identified person occurs when data explicitly relates to a specific individual. For example, a database containing the full name and address of a person. This data directly identifies the individual because it explicitly connects the information to that person. However, in the case of an identifiable person, attribution means that although the data does not directly identify an individual, it can be linked to them using other available information.  For instance, a list of random numbers or codes in a dataset where each number corresponds to a specific individual. On its own, the numbers do not identify anyone, but if the organisation has additional information, the data can be attributed to a specific individual. 

The EDPB highlights that pseudonymisation necessitates the application of a pseudonymising transformation. This process modifies the original data with one or several pseudonyms, new identifiers, so that the pseudonymised data cannot be attributed to a specific individual without additional information. This additional information can take various forms from tables mapping pseudonyms to original identifiers or cryptographic keys that allow the decryption of original data. The EDPB stresses that the effectiveness of pseudonymisation depends on the control and protection of this additional information, as it determines whether the data can be re-identified. 

Importantly, the EDPB points out that additional information used for re-identification may exist beyond the control of the data controller or processor, making it essential to evaluate all possible sources of attribution. Publicly available data, such as social media posts or online records, could facilitate the re-identification of individuals. Organisations should assess whether such external data could reasonably be expected to contribute to re-identification and, if so, take further protective measures. Additionally, the EDPB indicates that pseudonymised data is still personal data as long as it can be linked to an individual with additional information. The deletion of the additional information does not automatically render the pseudonymised data anonymous. The conditions of anonymisation would have to be met (i.e., anonymisation is irreversible). Pseudonymised data is still considered personal data, even when in the hands of third parties who do not have reasonable means to re-identify the individual.  

A new concept introduced in the Guidelines is the ‘Pseudonymisation Domain’. According to the Guidelines, the term refers to the context within which pseudonymisation prevents the attribution of data to specific individuals. This domain can be determined by the controller and may involve specific organisational units or external recipients. The EDPB encourages controllers to consider all scenarios, and re-identification attempts when assessing the measures necessary to protect the pseudonymisation process.  

Public criticism on potential contradiction with the EU case law 

In April 2023 the General Court of the European Union issued its ruling in Case T-557/20. The case related to the restructuring of Banco Popular by the Single Resolution Board (SRB). As part of a resolution scheme, the SRB asked affected shareholders and creditors to submit comments. These were pseudonymised and sent to the consulting firm supporting the SRB in its assessment. The Court held that the information disclosed to the firm should be considered personal data only if the firm had the legal means which would in practice enable it to access the additional information necessary to reidentify the authors of the comments. The European Data Protection Supervisor (EDPS) has since appealed this decision to the CJEU. 

On 5 February 2025, the Advocate General of the Court of Justice of the European Union (CJEU) issued its opinion in the case of C 413/23 P EDPS v Single Resolution Board. According to the Advocate General, personal data which has been pseudonymised and shared with a third-party should not automatically be considered personal data in the hands of the third-party recipient if the risk of re-identification is “non-existent or insignificant”. This opinion is important as it contradicts the EDPB guidelines. As mentioned above, the Guidelines support that pseudonymised data remains personal data as long as there is a means for either the controller or a third party to reidentify individuals.  

Implications of effective pseudonymisation 

Given the breadth of the Guidelines, we have included a non-exhaustive list of key practical implications of effective pseudonymisation for businesses: 

• Effective pseudonymisation may enable organisations to rely on legitimate interest as a legal basis and demonstrate compatibility with the original purpose of processing. For example, pseudonymisation may facilitate the data sharing with external recipients for other compatible purposes (e.g., research) due to the reduction of the re-identification risk. However, the organisation would still have to conduct a balancing test exercise to weigh whether its interests are overridden by the individuals’ rights.  

• The EDPB emphasises that additional information enabling re-identification should be kept outside the pseudonymisation domain. The organisation should identify any potential malicious actors and assess whether they could access any relevant additional information. Based on this assessment, the pseudonymisation process should be designed so that re-identification would require information beyond what these actors could reasonably obtain. The security measures put in place should align with the identified risks. 

• The EDPB advises that retaining additional information within the EU and separating it from the transferred data helps reduce the of risk of unauthorised access by foreign public authorities. However, pseudonymisation alone is often not sufficient as a safeguard and needs to be combined with other measures. 

Technical and Organisational measures 

Further to the legal analysis and the benefits of effective pseudonymisation, the Guidelines indicate in detail the technical and organisational measures that organisations should implement as part of the pseudonymisation. In summary, the EDPB calls for safeguards to prevent re-identification of pseudonymised data, proper management of pseudonyms and identifiers, and the separation of pseudonymisation domains from any re-identification information.  

Practical examples  

The Guidelines present ten real-world examples of pseudonymisation in various settings, showcasing its use in healthcare, employment, and business. The examples range from assessing medical advice from apps to restricting employee data access during quality checks. There are also instances on how pseudonymisation can help in data analysis and research fields.

The Guidelines offer valuable guidance for organisations, underscoring how pseudonymisation can foster trust and innovation in data handling while protecting individuals’ privacy rights. It will be interesting to see how the CJEU responds to the test of re-identification and when pseudonymised data can be considered personal data in the hands of a third party.  

Trilateral’s Cybersecurity and Data Protection teams are very experienced in advising on complex topics like pseudonymisation. If you wish to know more about how our data protection experts can support, check out the specialist services we provide and please get in touch to see how they can assist.