The European Data Protection Board has released comprehensive new guidelines that provide a detailed and structured framework for implementing pseudonymisation under the GDPR. These Guidelines 01/2025 offer essential clarity for organizations seeking to balance data utility with privacy protection in an increasingly regulated landscape, while recent court developments signal important shifts in how pseudonymised data is legally characterized.
Why These Guidelines Matter Now
The GDPR defines the term “pseudonymisation” for the first time in the EU law and refers to it several times as a safeguard that may be appropriate and effective for the fulfilment of certain data protection obligations.
Despite its importance, many organizations have struggled with practical implementation due to limited guidance. These new guidelines fill that gap, providing detailed technical and legal frameworks that organizations can follow.
The timing is crucial as data protection authorities increase enforcement activities and organizations face growing pressure to demonstrate compliance through technical measures rather than purely procedural safeguards. Moreover, recent case law from the Court of Justice of the European Union is reshaping how we understand when pseudonymised data constitutes “personal data” in different contexts.
Evolving Legal Landscape: The SRB-Deloitte Case and Its Implications
A landmark development in pseudonymisation law emerged from Case T-557/20, involving the Single Resolution Board (SRB) and Deloitte. The case concerned whether pseudonymised banking data transmitted during the Banco Popular Español resolution constituted personal data from Deloitte’s perspective as the recipient.
The General Court overturned the European Data Protection Supervisor’s decision, emphasizing that whether information constitutes personal data must be assessed from the recipient’s viewpoint, considering their actual ability to re-identify data subjects. This approach challenges the traditional assumption that all pseudonymised data automatically qualifies as personal data regardless of context.
Advocate General Spielmann’s February 2025 Opinion
In a significant development, Advocate General Spielmann supported this contextual approach, arguing that pseudonymisation alone doesn’t automatically make information “personal data” when “the risk of identification is non-existent or negligible” from the recipient’s perspective. His opinion suggests courts should examine:
- The content, purpose, and effect of the information
- The recipient’s actual capability for re-identification
- The availability of additional information to the recipient
Implications for Practice
If adopted by the CJEU, this approach would strengthen pseudonymisation as a tool for limiting legal obligations when recipients lack access to additional identifying information. This represents a more pragmatic, context-sensitive interpretation that could significantly impact how organizations structure data sharing arrangements.
Understanding Pseudonymisation: More Than Just Masking Data
Pseudonymisation is defined in Art. 4(5) GDPR as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”.
This definition reveals three critical requirements that go beyond simple data masking:
- Data Transformation: The original data must be modified so attribution becomes impossible without additional information
- Separation of Additional Information: Any keys, tables, or other information needed for re-identification must be kept separate
- Technical and Organizational Safeguards: Robust measures must prevent unauthorized access to the additional information
Importantly, pseudonymised data, which could be attributed to a natural person by the use of additional information, is to be considered information on an identifiable natural person and is therefore personal data. This statement also holds true if pseudonymised data and additional information are not in the hands of the same person.
However, the evolving case law suggests this principle must be applied contextually, considering the recipient’s actual circumstances.
The Strategic Benefits: Risk Reduction Without Losing Data Value
In accordance with Rec. 28 GDPR, pseudonymising data reduces risks for data subjects while allowing general analysis.
The guidelines identify several key advantages:
Confidentiality Protection: Pseudonymisation prevents disclosure of direct identifiers to data recipients and reduces the severity of data breaches. Even if pseudonymised data is accessed without authorization, the impact on individuals is significantly reduced.
Function Creep Prevention: By limiting attribution capabilities, pseudonymisation prevents data from being used for incompatible purposes, particularly those requiring direct interaction with data subjects.
Enhanced Accuracy: The guidelines note that assigning different pseudonyms to individuals with similar characteristics can reduce the risk of incorrectly attributing data to the wrong person.
Operational Flexibility: Organizations can process data in original form for some purposes and pseudonymised form for others, providing flexibility while maintaining protection.
Implementation Framework: The Pseudonymisation Domain Concept
The guidelines introduce a crucial new concept: the “pseudonymisation domain.”
Data Controllers may define the context in which pseudonymisation is to preclude attribution of data to specific data subjects, generally on the basis of a risk analysis. They subject the additional information to technical and organisational measures to ensure that pseudonymised data cannot be attributed to data subjects by persons operating within that context.
This domain can be tailored to specific needs:
- A single organizational unit within a company
- A defined set of external recipients
- All authorized recipients of the data
- Protection against unauthorized third parties
The effectiveness of pseudonymisation depends heavily on properly defining and securing this domain, and the recent case law suggests courts will increasingly examine whether recipients can actually re-identify subjects within their operational context.
Technical Implementation: Beyond Simple Pseudonym Generation
The guidelines outline two main approaches for pseudonymising transformations:
Cryptographic Algorithms: Using message authentication codes (MACs) or encryption algorithms with secret keys. The guidelines recommend one-way functions for security, though encryption may be needed when easy reversal is required. Advanced techniques like Argon2 are specifically mentioned for enhanced security.
Lookup Tables: Creating tables that match identifiers with randomly generated pseudonyms. While requiring secure storage of potentially large datasets, this approach offers resistance to cryptanalytic attacks.
Critical implementation considerations include:
- Removing or replacing direct identifiers
- Addressing quasi-identifiers that could enable attribution
- Implementing appropriate entropy in secret parameters
- Planning for algorithm replacement if weaknesses are discovered
Compliance Applications: Meeting Multiple GDPR Requirements
The guidelines demonstrate how pseudonymisation supports various GDPR obligations:
Data Minimisation: By limiting access to identifying information while preserving analytical capability
Data Protection by Design and Default: As a technical measure that builds privacy into processing systems
Security of Processing: By reducing the impact of potential data breaches
Legitimate Interests Assessment: The risk reduction achieved through pseudonymisation can be considered when balancing interests under Article 6(1)(f), particularly in light of the evolving case law that considers recipient capabilities
International Transfers: As a supplementary measure for third country transfers where standard safeguards may be insufficient
Real-World Applications: Learning from Practical Examples
The guidelines include ten detailed examples showing pseudonymisation in action:
Medical Quality Control: A healthcare app uses pseudonymisation to enable quality analysis while limiting analyst access to patient identities, with a separate operational division handling any necessary patient notifications.
Research Data Sharing: A dental implant registry employs a trust center model where practices, a registry, and a trust center each hold different pieces of information, enabling research while preventing any single entity from identifying patients.
International Data Transfers: A company conducts employee surveys using carefully designed pseudonymisation to protect against third-country government access while still enabling meaningful analysis.
Cross-border Banking Resolution: The SRB-Deloitte case demonstrates how pseudonymisation can enable necessary data sharing for financial stability purposes while limiting identification capabilities.
These examples demonstrate that effective pseudonymisation often requires careful orchestration of multiple parties and technical measures, with the recipient’s actual capabilities being crucial for determining legal obligations.
Practical Takeaways for Organizations
Start with Clear Objectives: Define what risks you want to address through pseudonymisation before designing technical measures. The objectives will determine the appropriate technical approach and help define the pseudonymisation domain.
Assess Recipient Capabilities: Following the evolving case law, carefully evaluate whether data recipients can actually re-identify subjects with reasonable means. This assessment may affect whether the data constitutes “personal data” in their hands.
Map Your Pseudonymisation Domain: Clearly identify who should and shouldn’t be able to re-identify data subjects, then design technical and organizational measures accordingly. Consider the operational context of each recipient.
Don’t Forget Legal Nuances: While pseudonymised data generally remains subject to GDPR requirements, the evolving interpretation suggests a more contextual approach. Document your analysis of recipient capabilities and re-identification risks.
Plan for the Entire Data Lifecycle: Consider not just initial pseudonymisation but also data sharing, linking datasets, and potential re-identification needs. Different recipients may require different approaches.
Invest in Technical Infrastructure: Effective pseudonymisation requires robust access controls, secure key management, and careful system design – not just algorithmic choices. Consider advanced techniques like Argon2 for enhanced security.
Document Your Approach: The guidelines emphasize the importance of demonstrating effectiveness through proper documentation and risk assessment. This becomes particularly important under the contextual approach emerging from case law.
Consider Professional Implementation: Given the technical complexity, legal developments, and compliance implications, many organizations will benefit from specialist expertise in designing and implementing pseudonymisation systems.
Monitor Legal Developments: The legal landscape around pseudonymisation is evolving rapidly. Stay informed about court decisions and regulatory guidance that may affect your implementation.
Looking Forward: A Tool in Legal Evolution
The new guidelines make clear that while pseudonymisation is a powerful privacy-enhancing technique, it’s not a complete solution. It must be combined with other technical and organizational measures to achieve adequate protection. However, when properly implemented, pseudonymisation offers organizations a practical way to reduce privacy risks while maintaining the ability to derive value from their data.
The evolving case law adds another dimension: pseudonymisation may not only reduce risks but also, in certain circumstances, reduce legal obligations when recipients lack realistic re-identification capabilities. This development could significantly impact how organizations structure data sharing arrangements and assess compliance requirements.
For organizations serious about privacy-by-design, these guidelines provide the roadmap needed to implement pseudonymisation effectively, while the evolving legal landscape offers additional strategic opportunities for compliance optimization. The investment in proper implementation will pay dividends in reduced compliance risk, enhanced stakeholder trust, and greater flexibility in data use.
In conclusion, pseudonymisation has evolved from a supplementary technique to a core component of GDPR compliance strategies. Organizations now have both legal motivation and practical guidance to deploy it effectively. in the modern data protection toolkit. With both comprehensive implementation guidance and evolving legal recognition of its effectiveness, organizations have unprecedented clarity and incentive to deploy this critical privacy-enhancing technology. These guidelines provide the framework to use it effectively, while recent legal developments suggest courts are taking a more pragmatic approach to its application.