Recital 27a
Also numbered 27aThe Council texts of 21 May, 10 June and 18 June 2026 print a different recital 27a. The tracker keeps it as a separate provision: Recital 27b. ITRE–LIBE amendments 224, 225, 226 and 227 (CJ72-AM-786820, pages 148–152) propose a different recital 27a. The tracker keeps it as a separate provision: Recital 27a (new).
Changes since18 June 2026ST 10677/26, Recital 27b
Renumbered from Recital 27b. Changes the wording. Every text of this provision
Text as printed
Changes since 18 June · Changes since the Commission proposal
Pseudonymisation is one of the possible security measures within the meaning of Article 32 of Regulation (EU) 2016/679 and does not necessarily have to be applied in all cases. Its legal effect should depend upon its actual effectiveness in preventing identification of a natural person by the relevant recipient. Controllers and processors should remain free to use other equally effective or more effective technical and organisational measures capable of achieving the substantive confidentiality, integrity and data-protection outcomes required by this Regulation. Whether pseudonymisation is appropriate, should be assessed on a case-by-case basis and depends on the context, the nature of the personal data and the existence of other appropriate technical and organisational measures. The effective application of pseudonymisation may also be clarified for controllers and processors through the approval of specific codes of conduct in accordance with Article 40 of Regulation (EU) 2016/679, taking account of the specific characteristics of the processing carried out in certain sectors and the specific needs of micro, small and medium enterprises. Apart from pseudonymisation, other privacy-enhancing technologies could be applied as appropriate.