{"id":19621,"date":"2025-12-15T23:55:00","date_gmt":"2025-12-15T22:55:00","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=19621"},"modified":"2025-12-15T12:05:28","modified_gmt":"2025-12-15T11:05:28","slug":"pseudonymization-gdpr","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/","title":{"rendered":"Pseudonymization and personal data"},"content":{"rendered":"\r\n<p class=\"wp-block-paragraph\">Anonymization and pseudonymization are two security measures (covered in Article 32.1 of the GDPR) that can lead to confusion.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\" id=\"h-what-is-pseudonymization\">What is pseudonymization?<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Pseudonymized information is a set of data that cannot be attributed to an interested party without using additional information.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">It requires that such additional information be provided separately and, furthermore, be subject to technical and organizational measures designed to ensure that personal data are not attributed to an identified or identifiable natural person (Art. 4.5 of the GDPR).<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The pseudonymization process generates two new data sets: the pseudonymized information and the additional information that allows the pseudonymization to be reversed.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The pseudonymized dataset, and the additional information linked to said dataset, are within the scope of the GDPR, as well as the processing that generates them.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The processing of pseudonymized data is considered the processing of personal data; since the person can still be identified using additional information that is kept separately.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\" id=\"h-what-is-anonymization\">What is anonymization?<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Anonymous information, as we explained in a <strong><a href=\"https:\/\/www.rosello-mallol.com\/en\/anonymous-data\/\" target=\"_blank\" rel=\"noreferrer noopener\">previous post<\/a><\/strong>, is a set of data that is not related to an identified or identifiable natural person (Recital 26 of the GDPR).<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The anonymized data set is not within the scope of the GDPR (Recital 26 of the GDPR); although it may fall within the scope of other regulations (e.g., national security, public health, critical infrastructure, etc.).<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\" id=\"h-main-differences-between-anonymization-and-pseudonymization\">Main differences between anonymization and pseudonymization<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\"><strong>Anonymization:<\/strong><\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Process: Irreversible removal of direct identifiers and the ability to link data to a person.<\/li>\r\n\r\n\r\n\r\n<li>Reversibility: Not reversible.<\/li>\r\n\r\n\r\n\r\n<li>Regulatory application: Not subject to the GDPR, as the data cannot be attributed to an individual.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\"><strong>Pseudonymization:<\/strong><\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Process: Replacement of direct identifiers with a pseudonym or code, while maintaining the ability to re-identify with a separate key.<\/li>\r\n\r\n\r\n\r\n<li>Reversibility: Reversible if additional (key) information is available.<\/li>\r\n\r\n\r\n\r\n<li>Regulatory application: Subject to GDPR, as re-identification is possible.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\" id=\"h-is-pseudonymized-data-personal-data\">Is pseudonymized data personal data?<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Last September, the Court of Justice of the European Union (CJEU) <strong><a href=\"https:\/\/curia.europa.eu\/juris\/document\/document.jsf?text=&amp;docid=303863&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=3544745\" target=\"_blank\" rel=\"noreferrer noopener\">ruled<\/a><\/strong> a key Judgment to pseudonymization.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">In that Judgment, the CJEU establishes that pseudonymized data is not automatically anonymous; it remains personal data if there is a possibility of re-identification, by the Data Controller or by third parties, with additional information<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Therefore, pseudonymized data can be:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Personal: For whom it can be re-identified (since it is not entirely and irrevocably anonymized).<\/li>\r\n\r\n\r\n\r\n<li>Non-personal: For those who cannot, without disproportionate effort, link that data to a natural person.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The wording of the ruling has given rise to different perspectives on what should be considered personal data. Thus, two different views on this concept have emerged:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>The absolute doctrine: It considers as personal data any information that, directly or indirectly, could be associated with a natural person, however remote or improbable this link may be (Art. 4.1 of the GDPR).<\/li>\r\n\r\n\r\n\r\n<li>The subjective doctrine: Data will only be personal for someone who has reasonable means of linking this data to an individual.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Through this Judgment, the CJEU reaffirms the subjective doctrine and, at the same time, declares that pseudonymized data processed by a Data Controller may be personal data for him and not be so for a transferee, in case the latter cannot (reasonably) carry out a re-identification of the data.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\" id=\"h-practical-implications-of-the-ruling-on-data-protection\">Practical implications of the ruling on data protection<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">In cases where the pseudonymized data can be re-identified and is therefore considered personal data, the Data Controller must comply with the following obligations:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Legal basis (Art. 6 of the GDPR): There must be a sufficient legal basis for the transfer of data to a third party.<\/li>\r\n\r\n\r\n\r\n<li>Inform the data subject about the processing (Articles 13 and 14 of the GDPR): Data subjects must be informed about transfers to recipients who will receive their personal data and, at the same time, data subjects must be informed about transferees who will not be able to link the pseudonymized data with the data subjects.<\/li>\r\n\r\n\r\n\r\n<li>The assignee could be considered the Controller: The assignee could be considered the Controller of the processing if it can, reasonably, re-identify the interested party.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Conversely: if pseudonymized data does not allow the data controller to re-identify the subject, it could be considered non-personal data, and therefore the GDPR would not apply.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">That said, you should be aware that the GDPR still considers pseudonymized data as personal data, and that when in doubt, it is always advisable to prioritize the data subject&#8217;s rights as much as possible.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Author: <strong>Sandra Santiago<\/strong>, Lawyer.<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>Anonymization and pseudonymization are two security measures (covered in Article 32.1 of the GDPR) that can lead to confusion. What is pseudonymization? Pseudonymized information is a set of data that cannot be attributed to an interested party without using additional information. It requires that such additional information be provided separately and, furthermore, be subject to [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":19617,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_joinchat":[],"footnotes":""},"categories":[246],"tags":[395,1124,408,394],"class_list":["post-19621","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-gdpr-2","tag-gdpr-compliance","tag-privacy-2","tag-rgpd-es-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.7) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Pseudonymization and personal data | Rosell\u00f3 Mallol<\/title>\n<meta name=\"description\" content=\"What a pseudonymized data is, how pseudonymization works, and what the recent CJEU ruling means for data protection.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pseudonymization and personal data\" \/>\n<meta property=\"og:description\" content=\"Anonymization and pseudonymization are two security measures (covered in Article 32.1 of the GDPR) that can lead to confusion. What is pseudonymization?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/\" \/>\n<meta property=\"og:site_name\" content=\"Rosell\u00f3 Mallol\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-15T22:55:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"717\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"V\u00edctor Rosello Mallol\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@vic_rosello\" \/>\n<meta name=\"twitter:site\" content=\"@vic_rosello\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"V\u00edctor Rosello Mallol\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Pseudonymization and personal data | Rosell\u00f3 Mallol","description":"What a pseudonymized data is, how pseudonymization works, and what the recent CJEU ruling means for data protection.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/","og_locale":"en_US","og_type":"article","og_title":"Pseudonymization and personal data","og_description":"Anonymization and pseudonymization are two security measures (covered in Article 32.1 of the GDPR) that can lead to confusion. What is pseudonymization?","og_url":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/","og_site_name":"Rosell\u00f3 Mallol","article_published_time":"2025-12-15T22:55:00+00:00","og_image":[{"width":1280,"height":717,"url":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","type":"image\/jpeg"}],"author":"V\u00edctor Rosello Mallol","twitter_card":"summary_large_image","twitter_creator":"@vic_rosello","twitter_site":"@vic_rosello","twitter_misc":{"Written by":"V\u00edctor Rosello Mallol","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#article","isPartOf":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/"},"author":{"name":"V\u00edctor Rosello Mallol","@id":"https:\/\/www.rosello-mallol.com\/en\/#\/schema\/person\/7fa3cf4f56820cf83675a0e692ca85d6"},"headline":"Pseudonymization and personal data","datePublished":"2025-12-15T22:55:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/"},"wordCount":723,"publisher":{"@id":"https:\/\/www.rosello-mallol.com\/en\/#organization"},"image":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#primaryimage"},"thumbnailUrl":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","keywords":["gdpr","GDPR compliance","privacy","RGPD"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/","url":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/","name":"Pseudonymization and personal data | Rosell\u00f3 Mallol","isPartOf":{"@id":"https:\/\/www.rosello-mallol.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#primaryimage"},"image":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#primaryimage"},"thumbnailUrl":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","datePublished":"2025-12-15T22:55:00+00:00","description":"What a pseudonymized data is, how pseudonymization works, and what the recent CJEU ruling means for data protection.","breadcrumb":{"@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#primaryimage","url":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","contentUrl":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","width":1280,"height":717,"caption":"seudonimizacion"},{"@type":"BreadcrumbList","@id":"https:\/\/www.rosello-mallol.com\/en\/pseudonymization-gdpr\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Inici","item":"https:\/\/www.rosello-mallol.com\/en\/"},{"@type":"ListItem","position":2,"name":"Pseudonymization and personal data"}]},{"@type":"WebSite","@id":"https:\/\/www.rosello-mallol.com\/en\/#website","url":"https:\/\/www.rosello-mallol.com\/en\/","name":"Rosell\u00f3 Mallol","description":"Despatx advocats experts en TIC i Protecci\u00f3 de dades","publisher":{"@id":"https:\/\/www.rosello-mallol.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.rosello-mallol.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.rosello-mallol.com\/en\/#organization","name":"Rosell\u00f3 Mallol - Advocats especialistes en dret digital","url":"https:\/\/www.rosello-mallol.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rosello-mallol.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/logo-definitiu-web.png","contentUrl":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/logo-definitiu-web.png","width":4000,"height":736,"caption":"Rosell\u00f3 Mallol - Advocats especialistes en dret digital"},"image":{"@id":"https:\/\/www.rosello-mallol.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/vic_rosello","https:\/\/www.instagram.com\/rosellomallol\/","https:\/\/www.linkedin.com\/in\/victorrosello\/","https:\/\/www.youtube.com\/channel\/UCxcqAdksWzsEaZ5UYoFJd0Q\/featured"]},{"@type":"Person","@id":"https:\/\/www.rosello-mallol.com\/en\/#\/schema\/person\/7fa3cf4f56820cf83675a0e692ca85d6","name":"V\u00edctor Rosello Mallol","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f6654958ef1f1268656bc9e22a33eb75f1d1b2f74baf6b4715e291bdad9c5a5e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f6654958ef1f1268656bc9e22a33eb75f1d1b2f74baf6b4715e291bdad9c5a5e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f6654958ef1f1268656bc9e22a33eb75f1d1b2f74baf6b4715e291bdad9c5a5e?s=96&d=mm&r=g","caption":"V\u00edctor Rosello Mallol"},"url":"https:\/\/www.rosello-mallol.com\/en\/author\/victor-rosello\/"}]}},"jetpack_featured_media_url":"https:\/\/www.rosello-mallol.com\/wp-content\/uploads\/business-5475661_1280.jpg","_links":{"self":[{"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/posts\/19621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/comments?post=19621"}],"version-history":[{"count":1,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/posts\/19621\/revisions"}],"predecessor-version":[{"id":19622,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/posts\/19621\/revisions\/19622"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/media\/19617"}],"wp:attachment":[{"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/media?parent=19621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/categories?post=19621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rosello-mallol.com\/en\/wp-json\/wp\/v2\/tags?post=19621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}