CJEU clarifies when pseudonymised data counts as personal data in third‑party transfers

The question

When does pseudonymised data qualify as personal data in the context of transfers to third parties under the GDPR?

The key takeaway

The Court of Justice of the European Union (CJEU) has emphasised that pseudonymised data may not be personal data in the hands of a third party where it lacks the means to identify the data subject. The identifiable nature of the data subject must be assessed by the data controller at the time of collection of the data.

The background

The CJEU partly set aside the General Court’s judgment in EDPS v SRB, offering important clarification on the treatment of pseudonymised data under EU data protection law, namely when pseudonymised data constitutes personal data in the hands of a third party.

To assess the impact of Banco Popular Español SA’s resolution process, the Single Resolution Board (SRB) collected comments from affected individuals through a personalised online form. The responses were pseudonymised by assigning a unique alphanumeric code that only the SRB could use to re-identify individuals before being shared with Deloitte for analysis. The case originated from five complaints to the European Data Protection Supervisor (EDPS), in which data subjects argued that they had not been informed that their pseudonymised personal data would be shared with Deloitte.

The General Court sided with the SRB, finding that Deloitte could not identify the individuals and therefore the transferred information did not constitute personal data in Deloitte’s hands.

The development

The CJEU offered clarity on the concepts of personal data and pseudonymisation, overturning the General Court’s decision in part. The key takeaways from the CJEU’s decision are:

• personal opinions or views are likely amount to personal data as these are closely connected to their authors
• pseudonymised personal data may not be considered personal data when held by a third party that does not reasonably likely possess the means to re-identify the data subject
• controllers that hold personal data which is then pseudonymised are still subject to the normal data protection obligations such as complying with the principle of transparency.

Why is this important?

The recent CJEU decision is relevant as it clarifies that whether information qualifies as personal data depends on the party holding it and their realistic ability to re-identify individuals. This means the same dataset could be considered personal data in the hands of one organisation, but not for another.

Importantly, data controllers cannot avoid their data protection obligations and must inform individuals about potential data sharing, even if the data will be pseudonymised before the transfer. This places the compliance burden on the controller at the point of collection, rather than on the recipient of pseudonymised data. As a result, businesses must carefully review their data sharing practices, ensure privacy notices are up to date, and not assume that technical measures like pseudonymisation alone will remove legal risk, especially when outsourcing or working with third parties.

Although this decision specifically addresses the EU GDPR, it is expected to be persuasive when interpreting the UK GDPR as the core concepts remain the same across both UK and EU regimes.

Any practical tips?

Organisations should:

• not assume that pseudonymisation alone removes data from the scope of the GDPR and instead regularly assess whether recipients could reasonably re-identify individuals
• consider updating data processing and sharing agreements to address re-identification risks, compliance obligations and clarify roles, responsibilities, and safeguards
• map data flows and identify which parties hold re-identification keys
• document assessments of whether recipients could reasonably re-identify individuals, and
• provide staff training on the limits of pseudonymisation and when data remains subject to the GDPR.

Autumn 2025