General Data Protection Regulation, Pseudonymised Data and the Definition of Personal Data (Article 4(1) and (5), Recital 26)

Article 4(1) defines personal data as any information relating to an identified or identifiable natural person, one who can be identified, directly or indirectly, and Article 4(5) defines pseudonymisation as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that the additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Recital 26 provides that personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person, and that, to determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person, with regard to objective factors such as the costs of and the amount of time required for identification, the available technology at the time of the processing and technological developments.

In Case C-582/14, Breyer, the Court of Justice held, under Directive 95/46, that a dynamic IP address registered by an online media services provider constitutes personal data in relation to that provider where it has the legal means that enable it to identify the data subject with additional data which the internet service provider has about that person.

In Case C-413/23 P, European Data Protection Supervisor v Single Resolution Board, judgment of 4 September 2025, the Court of Justice held, on the parallel definition in Regulation (EU) 2018/1725, which it said is to be interpreted in the same way as Article 4(1) of the General Data Protection Regulation (GDPR), that pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data.

For a recipient, the Court held that pseudonymised data are not personal in nature only if the recipient is not in a position to lift the pseudonymisation measures during any processing under its control and the measures in fact prevent it from attributing the data to the data subject, including by cross-checking with other factors, and that where third parties have means reasonably allowing them to attribute the data to the data subject the data subject must be regarded as identifiable as regards the transfer and any subsequent processing by those third parties.

For the controller, the Court held that the identifiable nature of the data subject is assessed, for the purposes of the duty to inform the data subject of the recipients of the data, at the time of collection of the data and from the point of view of the controller, so that the duty applied before the transfer and irrespective of whether the data were personal data from the recipient's point of view.

Article 32(1), point (a), lists the pseudonymisation and encryption of personal data among the technical and organisational measures a controller and processor implement to ensure a level of security appropriate to the risk, and Article 25(1) names pseudonymisation as an example of an appropriate technical and organisational measure designed to implement data-protection principles.