Recital 27a

Pseudonymisation is one of the possible measures within the meaning of Article 25 and Article 32 of Regulation (EU) 2016/679 and does not necessarily have to be applied in all cases. Controllers and processors should remain free to use other equally effective or more effective technical and organisational measures capable of achieving the substantive confidentiality, integrity and data-protection outcomes required by this Regulation. Whether pseudonymisation is appropriate, should be assessed on a case-by-case basis and depends on the context, the nature of the personal data and the existence of other appropriate technical and organisational measures. It is important that pseudonymised data remains subject to appropriate security measures, taking into account the circumstances of a particular processing, in order to protect from the risk of loss, theft or unauthorised disclosure. The effective application of pseudonymisation may also be clarified for controllers and processors through the approval of specific codes of conduct in accordance with Article 40 of Regulation (EU) 2016/679, taking account of the specific characteristics of the processing carried out in certain sectors and the specific needs of micro, small and medium enterprises. It is important that Member States, supervisory authorities, the Board and the Commission support and encourage the drawing up of such code of conducts with regard to the pseudonymisation of personal data. Apart from pseudonymisation, other privacy-enhancing technologies could be applied as appropriate.