Processes de-identified data, in the European Union

Regulation (EU) 2016/679, Art. 4(1) and (5), recital 26 · Read the law's page

• If you hold the additional information that attributes pseudonymised data to a natural person, treat the pseudonymised data as personal data and apply the Regulation to it (Article 4(1) and (5) and recital 26).
• For processing to count as pseudonymisation, keep the additional information needed to attribute the data to a specific data subject separately and subject it to technical and organisational measures that ensure the data are not attributed to an identified or identifiable natural person (Article 4(5)).
• If you receive pseudonymised data, treat it as personal data unless you are not in a position to lift the pseudonymisation measures during any processing under your control and the measures in fact prevent you from attributing the data to the person, including by cross-checking with other factors, judged by the means reasonably likely to be used, with regard to cost, time, available technology and technological developments (recital 26; Case C-413/23 P, paragraphs 77 and 85 to 86).
• If you pass pseudonymised data to a recipient, assess whether the data subject is identifiable from your own point of view as controller at the time of collection, whether or not the data are personal for the recipient, when you give the data subject the information about recipients (Case C-413/23 P, paragraphs 111 and 112, decided on the corresponding duty in Regulation (EU) 2018/1725).
• Where you apply pseudonymisation as a security or design measure, treat it as one of the technical and organisational measures Article 32(1), point (a), and Article 25(1) refer to, and not as a ground for taking the data outside the Regulation (Articles 25(1) and 32(1), point (a), and recital 28).

Regulation (EU) 2025/327, Arts. 61, 66, 73 · Read the law's page

• If you are a health data user, do not re-identify or attempt to re-identify the natural persons to whom electronic health data obtained on the basis of a data permit, a health data request or an access approval relate (Article 61(3)).
• If you are a health data user processing electronic health data within a secure processing environment, do not provide access to the data, or make it available, to third parties not mentioned in the data permit (Article 61(2)).
• If you are a health data user, make public the results or output of secondary use within 18 months of completing the processing in the secure processing environment or of receiving the response to your health data request, a period the health data access body may extend in justified cases, and let those results or that output contain only anonymous data (Article 61(4)).
• If you are a health data access body, provide electronic health data in an anonymised format where the health data user's purpose can be achieved with such data, and provide it in pseudonymised format only where the user has sufficiently demonstrated that anonymised data cannot achieve the purpose, keeping the information needed to reverse the pseudonymisation with the access body or a trusted third party acting under national law (Article 66(2) and (3)).
• If you are a health data access body, give access to electronic health data under a data permit only through a secure processing environment that restricts access to the persons listed in the data permit, gives each user a unique identity and a confidential access mode, limits input, inspection, modification and deletion to a limited number of authorised identifiable individuals, minimises the risk of unauthorised reading, copying, modification or removal, keeps identifiable logs of access and activities for the period needed to verify and audit processing, with logs of access kept for at least one year, and monitors compliance with those measures (Article 73(1), points (a) to (f)).
• If you are a health data access body, review each download request so that health data users can download only non-personal electronic health data, including data in an anonymised statistical format, and have the secure processing environments audited on a regular basis, including by third parties, correcting the shortcomings, risks or vulnerabilities the audits identify (Article 73(2) and (3)).