Article 30a – Application of pseudonymisation and identification of a natural person

30a - Application of pseudonymisation and identification of a natural person (1) Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information. To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, such as singling out or online identifiers, either by the controller or by another person to identify the natural person directly or indirectly.

The application of pseudonymisation to personal data may, depending on the circumstances of the case and provided that appropriate technical and organisational measures are put in place and are such as to prevent the data in question from being attributed to the data subject, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable.

Paragraphs 1 and 2 are without prejudice to other provisions and obligations applicable to the controller, including under Chapter IV and V of this Regulation. The provision set out in paragraph 2 shall not apply to processors.

The European Data Protection Board shall issue an opinion, in accordance with Article 64(2) of the Regulation (EU) 2016/679, addressing the application of pseudonymisation and anonymisation, including the related circumstances and technical and organisational measures referred to paragraph 2.