Is Pseudonymised Data Still Personal Data Under GDPR?
A 2025 EU court ruling and new EDPB guidelines explain when pseudonymised data still counts as personal data, and what that means for shared documents.
Pseudonymised data is still personal data for whoever holds the key to reverse it. For a recipient with no way to re-identify anyone, a 2025 EU court ruling says the same file may not be personal data at all. The answer depends on who is looking at the file, not only on the technique used to mask it.
What does pseudonymisation mean under GDPR?
Article 4(5) of the GDPR defines pseudonymisation as processing personal data so it can no longer be linked to one specific person without extra information. That extra information must be stored separately, protected by technical and organisational measures. In plain terms, you swap a name for a code, and you lock the code list away from the file itself.
Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. Recital 26, GDPR.
What do the 2025 EDPB guidelines add?
The European Data Protection Board adopted Guidelines 01/2025 on Pseudonymisation on 16 January 2025 and opened them for public comment until 14 March 2025. As of September 2026, the EDPB had not published a final version, so the January 2025 text remains the reference. The guidelines introduce a useful idea, the pseudonymisation domain: the exact group of people who are meant to be kept from re-identifying anyone. Outside that group, the same protection may not hold.
What did the court decide in EDPS v SRB?
In EDPS v SRB, case C-413/23 P, the Court of Justice of the EU ruled on 4 September 2025. The case technically applies Regulation 2018/1725, the sister regulation to the GDPR for EU institutions. Its test for personal data mirrors the GDPR's, so lawyers treat the reasoning as relevant to GDPR cases too. The Single Resolution Board had pseudonymised comments from Banco Popular shareholders and sent them to Deloitte for a financial review. The European Data Protection Supervisor argued Deloitte had received personal data and that shareholders should have been told. The Board disagreed.
The Court took a middle position. Pseudonymised data must not be treated as personal data in all cases and for every person, the judgment says. If a recipient like Deloitte truly cannot re-identify anyone, the file may not be personal data for that recipient. But the sender's own duties do not disappear. The sender must still tell people about who receives their data. That is judged from the sender's side, at the time of collection, no matter what happens to the file later.
| Technique | Reversible? | Personal data for the sender? | Personal data for the recipient? |
|---|---|---|---|
| Full anonymisation, key destroyed | No | No, once truly anonymous | No |
| Pseudonymisation, sender keeps the key | Yes | Yes, always | Often not, if re-identification is not realistic for them |
| Pseudonymisation, key shared with the recipient | Yes | Yes | Yes |
| Black-marker redaction of chosen values | No, for those values | No, for those values | No, for those values |
What does this mean for a document you send?
Say Jane Example, an HR manager, replaces every employee name in a report with a code like [NAME12] before sending it to an outside auditor. Jane keeps the name list on her side. For Jane, the report stays personal data: she can reverse it in seconds. For the auditor, it may not be. That depends on whether the auditor can get that list, or has some other realistic way to guess who is who.
ONYRI Sanitize's Token mode, on the Pro plan, does this kind of pseudonymisation. It replaces each value with a consistent label, and ONYRI keeps no key, so it cannot restore the original file for you. That does not make the document anonymous in your own hands. You still hold the source file, so under the reasoning above, the tokenised copy stays personal data for you, the sender.
- Ask who will hold the key: you, the recipient, or nobody at all.
- Check whether the recipient could re-identify people another way, for instance by matching other data they already hold.
- Write down your reasoning when you decide a file is not personal data for a recipient. A regulator may ask for it later.
- Remember your own duties do not disappear: your obligation to inform people is judged from your side, not the recipient's.
None of this is legal advice, and national authorities do not always read these rulings the same way. When the stakes are high, such as a large transfer or special category data, ask a data protection officer or a lawyer. Do this before you treat a file as no longer personal data for its recipient.
Frequently asked questions
Is pseudonymised data the same as anonymised data?
No. Anonymisation removes the link to a person for good. Pseudonymisation keeps a way back, through a key or extra information kept elsewhere. GDPR Recital 26 treats pseudonymised data as information about an identifiable person, unless it meets the stricter conditions for full anonymity.
Who decides whether my recipient can re-identify someone?
You do, as the sender, and you have to judge it honestly. Look at what the recipient already holds, what they could realistically get, and how much effort re-identification would take. If it would be easy for them, treat the data as personal for them too.
Does the EDPS v SRB ruling let me share pseudonymised files freely?
No. The Court of Justice only said pseudonymised data is not automatically personal data for every recipient in every case. Your own duties as the sender, including telling people about the transfer, are judged from your side and still apply.
What did the 2025 EDPB guidelines change?
They did not change the law. They explain how to apply Article 4(5) in practice. That includes how to define who sits inside the pseudonymisation domain, and how to keep the key away from them. As of September 2026, the guidelines are still the January 2025 draft. Check the EDPB site for a final version.
What should I check before sending a pseudonymised document to a third party?
Confirm who holds the key, note whether the recipient could re-identify people another way, and write down your reasoning. Keep your original file and its key list separately, and review your information notice to data subjects so it reflects the transfer.
Sources & references
- Article 4(5) GDPR — definition of pseudonymisationIntersoft Consulting (GDPR full text)
- Recital 26, GDPR — pseudonymised data and identifiabilityIntersoft Consulting (GDPR full text)
- Guidelines 01/2025 on PseudonymisationEuropean Data Protection Board
- Press release 107/25 — Judgment in Case C-413/23 P, EDPS v SRBCourt of Justice of the European Union