Article 29a

Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. The Commission may adopt implementing acts to specify means and criteria to determine whether a natural person is identifiable, including through personal data having undergone data resulting from pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly no longer constitutes personal data for certain entities.

The application of pseudonymisation to personal data may, depending on the circumstances of the case and provided that appropriate technical and organisational measures are put in place and are such as to prevent the data in question from being attributed to the data subject, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable.

Where a person other than the controller referred to in paragraph 2 discloses, transmits or otherwise makes such data available to a third party and it cannot be ruled out that this third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to this third party and the subsequent processing of the data by this third party is to be considered as processing of data relating to an identifiable natural person.