Article 29a – Application of pseudonymisation and identification of a natural person
Also numbered 29aITRE–LIBE amendment 1169 (CJ72-AM-791073, pages 100–101) proposes a different Article 29a. The tracker keeps it as a separate provision: Article 29a (new).
Changes since19 November 2025COM(2025) 837, Art 41a
Renumbered from Article 41a. Five paragraphs become four. Paragraph 3 refers to paragraph 1 for the opinion: see paragraph 3. Every change, paragraph by paragraph
Text as printed
New provision · Changes since the Commission proposal
Controllers and processors may apply pseudonymisation to personal data in order to reduce the risks to the data subjects concerned and to help meet their obligations under this Regulation.
To determine whether a natural person is identifiable, account shall be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.
The Board shall issue an opinion, in accordance with Article 64(2) of this Regulation, addressing the application of pseudonymisation and anonymisation, including related technical and organisational measures, and specifying means and criteria to determine whether and when the application of pseudonymisation to personal data may effectively prevent persons other than the controller from identifying a data subject, in such a way that, for them, the data subject is not or is no longer identifiable.
The Chair of the Board shall request the opinion referred to in paragraph 1 no later than 12 months after the entry into force of this Regulation. The opinion shall be reviewed and updated where necessary.
Cross-referenceParagraph 3 cites ‘the opinion referred to in paragraph 1’. Paragraph 1 mentions no opinion. Paragraph 2 provides for it.