United KingdomUK GDPR, personal data, pseudonymisation and processing which does not require identification
In force since .
A de-identification rule binding public and private bodies.
- Obligation class
- Data subject rights
What it requires
- Where you can demonstrate that you are not in a position to identify the data subject because the purposes of your processing do not or no longer require identification, inform the data subject accordingly, if possible (Article 11(2)).
- Where Article 11(2) applies, give effect to a data subject's rights under Articles 15 to 20 once the data subject provides additional information enabling identification (Article 11(2)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Penalty structure
UK GDPR Art. 83(4)(a) sets administrative fines for infringement of the controller's and processor's obligations under Article 11 at up to the higher of £8,700,000 or 2% of total worldwide annual turnover of the preceding financial year.
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 8,700,000
- Turnover percentage cap
- 2
What this law does
Article 4(1) point (1) of the UK GDPR defines personal data as any information relating to an identified or identifiable natural person, an identifiable natural person being one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Article 4(1) point (5) of the UK GDPR defines pseudonymisation as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that the additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
The existing text of Article 4 of the UK GDPR was renumbered as Article 4(1) from by the Data (Use and Access) Act 2025.
Article 11(1) of the UK GDPR provides that if the purposes for which a controller processes personal data do not or no longer require the identification of a data subject by the controller, the controller is not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the Regulation.
Under Article 11(2) of the UK GDPR, where the controller is able to demonstrate that it is not in a position to identify the data subject, the controller must inform the data subject accordingly, if possible. Where Article 11(2) applies, Articles 15 to 20 of the UK GDPR do not apply except where the data subject, for the purpose of exercising rights under those articles, provides additional information enabling the data subject's identification.
Infringements of the obligations of the controller and the processor under Article 11 of the UK GDPR are subject to administrative fines up to £8,700,000, or in the case of an undertaking up to 2% of the total worldwide annual turnover of the preceding financial year, whichever is higher.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .