Amendment 1302· GDPR Article 41b (new)
+Addition
Text of the amendment
As tabled
Amending instruction
10a. The following Article 41b is inserted
Article 41b it would add
Article 41b
Application of pseudonymisation and identification of a natural person
(1)Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly.
(2)Paragraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation.
(3)The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller.
(4)The Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.
(5)The Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
GDPR Article 41b with this amendment
Amendment 1302 applied to the Commission proposal, no other amendment
Controllers and processors may apply pseudonymisation, and anonymisation, or other Privacy Enhancing Technologies referred to in Article 25a to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly.
+NewParagraph 1 is without prejudice to other provisions and obligations applicable to the controller and processor, including under Chapter IV and V of this Regulation.
+NewThe Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation to personal data, including related technical and organisational measures, and specifying means and criteria to determine whether and when such may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable, and where information relating to the data subject no longer constitutes personal data for that person other than the controller.
+NewThe Chair of the Board shall request the opinion referred to in paragraph 3 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.
+NewThe Commission may adopt implementing acts specifying technical and organisational criteria, methodologies and standards where necessary to ensure uniform conditions for the application of paragraphs 1 and 3, or where further clarity is required following the issuance of the opinion referred to in paragraph 3, The Commission shall closely involve the EDPB in the preparations of the implementing acts. The EPDB shall issue an opinion on the draft implementing acts within a deadline of 8 weeks as of the receipt of the draft from the Commission. The Implementing Acts shall be adopted in accordance with the examination procedure referred to in Article 93(3).
+NewTarget
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 41b (new).
Cite this amendment
Amendment 1302 (Aura Salla and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 25–27
Link, short form and official text
Amendment 1302 (Aura Salla and others), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1261–1564 to the draft report on COM(2025) 837 (CJ72-AM-791873, PE791.873v01-00, 27 July 2026), pp. 25–27
ITRE–LIBE Amendment 1302 (CJ72-AM-791873), p. 25