Article 4

(a) In point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

(a) in point 1, the following sentences are added: ‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Tracker noteThis amendment moves the Commission’s instruction from point (1) to point (5) and proposes its own wording there. Whether the Commission’s original wording for point (1) would still be added has not been established, so no amended version of the article is shown.

(a) in point 1 5, the following sentences are added:

Justification

Codifies the judgment of the Court of Justice in Case C-413/23 P (EDPS v SRB) at the place where the Court itself situated it. Pseudonymisation does not form part of the definition of personal data (paragraph 72). Pseudonymised data remain personal data for the controller holding the additional information (paragraph 76) and cannot as such be regarded as anonymised (paragraph 73). They may, however, not be regarded as personal data in relation to a recipient where the technical and organisational measures have been effectively implemented and prevent that recipient from attributing the data to the data subject, including by combination with other information, so that the risk of identification is insignificant (paragraphs 75, 77 and 82). Where onward transmission to third parties able to re-identify cannot be excluded, the data remain personal data (paragraph 85).

‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Justification

The Commission introduces into the very definition of personal data the principle that information is not personal for an entity which cannot identify the natural person concerned. This exceeds a technical amendment: it modifies the definition of a fundamental right, restricts the scope of the Regulation and creates legal uncertainty, as both the EDPB and the EDPS have stressed. The relativity of identifiability confirmed by the Court of Justice belongs to the notion of pseudonymisation (Case C-413/23 P, paragraphs 71 to 72), not to Article 4(1). The definition of personal data therefore remains unchanged, and the graded regime introduced in the following amendments provides the legal certainty sought without distorting the Court’s method.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.Information relating to a natural person does not necessarily constitute personal data for every person or entity, merely because another person or entity can identify that natural person. Whether or not information constitutes personal data should be assessed on a case-by-case basis, with regard to each person or entity that holds or receives that information, taking into account all means reasonably likely to be used by that person or entity to identify the natural person concerned, including the costs, time required and available technology. Information shall not be personal for a given person or entity where that person or entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used. byDepending on the circumstances, pseudonymisation may prevent a person or entity other than the controller from identifying the data subject, such that, for that person or entity, the data subject is not, or is no longer, identifiable. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’That does not affect the classification of that information as personal data for the controller, nor its obligations under Articles 13 and 14.

Information relating to a natural person isdoes not necessarily constitute personal data for every other person or entity, merely because another entity canis able to identify that natural person. Information shall not beconstitute personal data for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likelyavailable to be used by that entity and to third parties operating in the same sector or geographical context. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available. (Our intention is to amend part of the article in question)

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity and by third parties operating in the same sector or geographical area. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates, provided that, where the information refers to economic activities with a high degree of geographical concentration, the combination of geographical, production-related and size-related variables is taken into account for the purposes of assessing the resources that can reasonably be made available.

Justification

La modifica al dispositivo dell’articolo 4, punto 1, del regolamento (UE) 2016/679 è coerente con il correttivo interpretativo introdotto al considerando 27 mediante l’Emendamento 1. Non altera l’impostazione della proposta della Commissione secondo cui un’informazione può non costituire dato personale per una determinata entità in mancanza di mezzi ragionevolmente utilizzabili per l’identificazione; ma vincola tale valutazione all’esame dei mezzi accessibili nel contesto settoriale e territoriale pertinente, evitando che la specificità semantica dei dati generati da attività economiche territorializzate produca un effetto di de-protezione.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.Information relating to a natural person, depending on the circumstances of the case, is not necessarily personal data for every other person or entity, in so far as that person or entity cannot identify that natural person to whom the information relates taking into account the means reasonably likely to be used by that person or entity, Information relating to a natural person is, however, personal data where this information is likely to be put or is put at the disposal of other persons or entities who have the means reasonably likely to enable the data subject to be identified.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The means reasonably likely to be used by a specific entity shall be assessed in the light of that entity’s actual technical capabilities, having regard to the ressources, costs, available technical means and time required for identification, rather than hypothetical possibilities.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates. The parameters of a trained AI model do not constitute personal data where, taking into account the means reasonably likely to be used, a natural person whose personal data was processed during training cannot be identified from the model.

Justification

In line with the case law of the Court of Justice of the European Union (ECLI:EU:C:2025:645), the training of an AI model should not be considered as processing of personal data solely on the ground that its output may contain references to personal data. Such an output constitutes the statistically most probable result generated by the model, rather than the retrieval or reproduction of personal data as such.

Information relating to a natural person, is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. That assessment shall take into account objective factors, including but not limited to costs, time, available technology and the legal means available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used bythrough technical and organisational measures, as well as state of the art technology available to that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

‘Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity.When determining whether a natural person is identifiable, account shall be taken of all the means reasonably likely to be used by the controller, an actual or foreseeable recipient or any other actor in the processing chain. Pseudonymised data remains personal data, provided that re-identification by an actual or foreseeable recipient is legally and practically possible. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.’The controller shall bear the burden of demonstrating that the risk of re-identification is objectively insignificant, taking into account the state of the art, available additional information and the intended audiences. A contractual ban on re-identification alone shall not suffice.

Justification

Protection must not depend on whether an individual actor claims at any given time that they are unable to identify themselves. What matters is the real risk throughout the entire processing chain.

Information relating to a natural person is not necessarily personal data for every other person or entity, merely because another entity can identify that natural person.Regulation (EU) 2016/679 shall not apply to the processing of personal data, including sensitive personal data, where: (a) the processing is merely transitory in nature; and (b) the processing is for a purpose that is unrelated to the data subject as an identified or identifiable natural person; and (c) appropriate technical and/or organisational safeguards are in place to prevent any use of the data for a purpose related to the data subject as an identified or identifiable natural person up to the point when the data are irreversibly anonymised or erased. Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.

In Article 4, point 1, the following part is added

(32) ‘terminal equipment’ means terminal equipment as set out in Article 1(1) of Directive 2008/63/EC;

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;

(33) for ‘electronic communications networks’ the definition of Article 2(1) of Directive (EU) 2018/1972 shall apply;the definitions of ‘electronic communications network’, ‘electronic communications service’, ‘interpersonal communications service’ in points (1), (4) and (5) respectively of Article 2 of Directive (EU) 2018/1972 shall apply. For the purposes of this Regulation, the definition of ‘interpersonal communications service’ shall include services whether provided for remuneration or not, as well as services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service;

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

(33) for ‘electronic communications networks’ themeans definitiontransmission systems as defined in of Article 2(1) of Directive (EU) 2018/1972 shall apply;

(34) ‘web browser’ means web browser as defined in Article 2(11) of Regulation (EU) 2022/1925;

(35) ‘media service’ means a media service as defined in Article 2(1) of Regulation (EU) 2024/1083;

(36) ‘media service provider’ means a media service provider as defined in Article 2(2) of Regulation (EU) 2024/1083;’

(37) ‘online interface’ means an online interface as defined in Article 3(m) of Regulation (EU) 2022/2065.’

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.’

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration.“scientific research” means any research which: a. follows a methodical and systematic approach; b. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.adheres to ethical standards in the relevant research field, including the respect for human autonomy and the concept of consent to participate in research, transparency, accountability and oversight; c. is genuinely intended to produce verifiable and transparent results; d. is autonomous and independent and not subject to undue external influence; e. is carried out with the genuine19 aim of contributing to the growth of society’s general knowledge and wellbeing, which does not exclude subsequent commercial interests and; f. has the potential to contribute to existing scientific knowledge or apply existing knowledge in novel ways. This does not exclude that the research may also aim to further a commercial interest.

Justification

Based on EDPB guidelines 1/2026 on processing of personal data for scientific research purposes of April 2026.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. Scientific research shall not include the profiling of natural persons, direct marketing, the monitoring of individuals' behaviour, or activities whose purpose is to influence or nudge the behaviour of natural persons, even where such activities apply scientific methods.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest. The development, training, testing and validation of new technologies, such as AI systems, AI models and AI agents may be topics of scientific research where it meets the conditions of this point.

Justification

Clarifying that the development of new technologies, such as the training of an LLM, may also be considered as scientific research.

(38) “scientific research” means any research which can also support innovation, such as technological development, demonstration, applied research and demonstrationprivately funded research. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.This does not exclude research testing or development of AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means research conducted in an autonomous and independent manner, with the aim of contributing to the growth of society’s public knowledge, to the public interest or to serve the mankind, generating new or complementing existing scientific knowledge, following a methodological and systematic approach consistent with generally recognised ethical standards, including the respect for human autonomy and the concept of consent to participate in research, as well as standards applicable in the relevant scientific field, producing evidence-based, testable, transparent and published results. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.This does not exclude the research testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service or the aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.“scientific research” means any research conducted in autonomous and independent manner, with the aim of contributing to the growth of society’s general knowledge and wellbeing, adhere to recognised ethical standards for scientific research in the public interest, with respect to human autonomy and producing verifiable and transparent results.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means research that follows a methodical and systematic approach, adheres to all ethical and other standards in the relevant research field, is able to produce verifiable and transparent results, and is carried out in an autonomous and independent manner with the genuine objective of contributing to the growth of society’s general knowledge. This does not exclude that the research may also aim to further a commercial interest.

Justification

based on EDPB-EDPS Joint Opinion and EDPB Guidelines 1/2026, section 2.1

38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area.“scientific research” means creative and systematic work undertaken in order to increase the stock of knowledge, either through experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts without any particular application or use in view, or through original investigation undertaken in order to acquire new knowledge directed primarily towards a specific, practical aim or objective. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards, including scientific methods, in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Justification

Generally, the definition should not be too restrictive and prevent innovation. Scientific research is foremostly defined by using scientific methods, which should be explicitly mentioned. The definition should not include restrictive conditions linked to the specific entity conducting the scientific research. The qualification of an activity as scientific research should depend on the nature of the research itself, rather than on the characteristics or status of the organisation carrying it out.

38. “scientific research” means any research which can also support innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. they shall be carried out with the aim of contributing to the development of the general knowledge and well-being of society, while respecting ethical standards in the field of research concerned.“scientific research” means methodologically systematic, traceable and accountable research that is carried out in accordance with recognised scientific and ethical standards, follows a documented research agenda and serves the advancement of knowledge or a clearly defined public interest. A commercial interest does not preclude scientific research if it is secondary to the purpose of the research. General product development, targeted advertising, profiling, data trading and the training of general AI systems or AI models are not considered scientific research in themselves. This does not exclude that the research may also aim to further a commercial interest.’

Justification

Research privileges are intended for genuine science, not to be used as a blanket legal basis for commercial data exploitation.

(38) “scientific research” means any research which can also support competitiveness, innovation, such as technological development and demonstration. These actions shall contribute to existing scientific knowledge or apply existing knowledge in novel ways, be carried out with the aim of contributing to the growth of society’s general knowledge and wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

(38) “scientific research” means any research which can also support innovation, such as technological development and demonstration.“scientific research” means any research activity including technological development demonstration, fundamental research, applied research and privately funded research. These actions shall contribute to existing scientific knowledge or, apply to existing knowledge in novel ways, or be carried out with the aim of contributing to the growth of society’s general knowledge andor wellbeing and adhere to ethical standards in the relevant research area. This does not exclude that the research may also aim to further a commercial interest.

Justification

Scientific research should be defined by its purpose, methodology and contribution to knowledge, not by whether it is carried out by academia, public bodies or companies. The amendment codifies the broad approach already reflected in GDPR Recital 159, covering technological development, demonstration, fundamental, applied and privately funded research. Commercial interest alone should not exclude genuine research from the GDPR research framework or Article 89 safeguards.

Justification

RISK-BASED APPROACH #5: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

Justification

RISK-BASED APPROACH #6: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.

Justification

RISK-BASED APPROACH #7: This package makes the GDPR’s risk-based approach practical by introducing objective categories for small, medium and large controllers. Small controllers with limited, non-core processing receive relief from selected administrative duties, while data-subject rights and enforcement remain intact. Very large controllers, gatekeepers and VLOPs/VLOSEs face stronger transparency, annual certification and closer supervision. Compliance effort is thus reduced where risks are low and increased where scale and systemic impact are greatest.

Justification

Defines the recognised privacy-enhancing techniques on which the graded regime rests: pseudonymisation and key separation, encryption at rest and in transit, aggregation and generalisation, statistical noise and differential privacy, synthetic data, secure multi-party computation, secure processing environments, and contractual and organisational prohibitions on re-identification. The technical criteria are to be specified by implementing act, in cooperation with the EDPB, so as not to freeze in the Regulation a state of the art which is bound to evolve.

Justification

This change is proposed due to other amendments tabled moving e-privacy provisions under Regulation (EU) 2016/679.