Article 25a – Application of pseudonymisation and identification of a natural person
Also numbered 25aITRE–LIBE amendment 1159 (CJ72-AM-791073, pages 84–89) proposes a different Article 25a, ‘Privacy Enhancing Technologies’. The tracker keeps it as a separate provision: Article 25a (new).
Changes since18 June 2026ST 10677/26, Art 29a
Renumbered from Article 29a. Five paragraphs become seven. Paragraph 7 still refers to paragraph 4 for the opinion: see paragraph 7. Every change, paragraph by paragraph
Text as printed
New provision · Changes since 18 June · Changes since the Commission proposal
10. The following article is added:
Controllers and processors may apply pseudonymisation in order to reduce the risks to the data subjects concerned and to comply with their obligations under this Regulation, in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information.
Pseudonymised data shall not be considered personal data for a person if that person is unable to identify the natural person to whom the data relates, unless paragraph 5 applies.
To determine whether a natural person is identifiable, including through personal data having undergone pseudonymisation, account shall be taken of all the means reasonably likely to be used, either by the controller or by another person to identify the natural person directly or indirectly. A natural person is not identifiable where the likelihood of identification is insignificant in practice.
Where a processor processes personal data on behalf of a controller, that information shall be considered personal data for the processor, and the processor continues to be subject to the obligations applicable under this Regulation.
Where a person other than the controller discloses, transmits or otherwise makes such data available to a third party and, in light of all relevant circumstances, the third party possesses or can obtain means reasonably likely to enable the data subject to be identified, both the transmission of the data to this third party and the subsequent processing of the data by this third party is processing of personal data.
The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures.
The Chair of the Board shall request the opinion referred to in paragraph 4 no later than 6 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.
Cross-referenceParagraph 7 cites ‘the opinion referred to in paragraph 4’. Paragraph 4 mentions no opinion. Paragraph 6 provides for it. In the 18 June 2026 text the same words sat in Article 29a(5), when paragraph 4 held the opinion.