The Lawxy Times
EU governments narrow GDPR pseudonymised data scope
On 7 September 2026 the European Council and the European Commission adopted a compromise that revises the scope of pseudonymised data under Regulation (EU) 2016/679. The amendment clarifies that data which a controller cannot use to identify an individual no longer falls within the definition of personal data for that controller. Data‑driven enterprises that rely on pseudonymisation are immediately affected, as many processing activities may now be exempt from the Regulation’s core obligations. The change also delineates the limits of the AI‑related legitimate‑interest provision and the contextual‑advertising exemption.
Full News Breakdown
The dispute originated in the Digital Omnibus package, where member states and the Commission could not agree on whether pseudonymised records should always be treated as personal data. The compromise resolves the disagreement by linking the personal‑data status to the controller’s actual ability to re‑identify the data subject. The final text therefore narrows the regulatory reach for organisations that lack the technical means to reverse pseudonymisation.
Case Name: Digital Omnibus compromise (2026)
Instrument: Regulation (EU) 2016/679
Key Provisions: Article 4(1) definition of personal data, Article 4(5) pseudonymisation, Article 6(1)(f) legitimate interest
Primary Legal Issue: Whether pseudonymised information remains “personal data” when the processor cannot identify the individual
Applicant Arguments: Several member states argued that any pseudonymisation should remain within the Regulation to preserve data‑subject protections
Respondent Arguments: The Commission maintained that the Regulation should only apply where re‑identification is technically feasible for the controller
Holding: Pseudonymised data are not personal data for an organisation unable to identify the individual, while the general definition of personal data remains unchanged
Practical Outcome: Controllers that cannot re‑identify pseudonymised records may avoid data‑subject rights obligations, DPIAs and certain lawful‑basis requirements; AI‑related legitimate‑interest claims are reinstated, cookie rules are tightened, and a narrow exemption for contextual‑advertising measurement is introduced
How Does This Affect You?
Before the compromise, practitioners faced uncertainty about whether every pseudonymised data set triggered GDPR compliance, even when the controller lacked de‑identification capability. The new wording resolves that uncertainty by expressly excluding such data from the Regulation’s scope for that controller. Consequently, organisations can now rely on a clearer exemption, but must still demonstrate the inability to re‑identify individuals to benefit from the narrowed reach. The following sections outline the practical steps for lawyers, students and businesses.
For Lawyers & Advocates
Re‑classify data sets that are pseudonymised and for which the controller lacks the technical means to re‑identify the data subject as non‑personal, thereby removing the requirement to conduct a Data Protection Impact Assessment under Article 35.
Amend existing data‑processing agreements to insert a clause confirming the controller’s inability to identify individuals from the pseudonymised records, which will limit liability and streamline cross‑border transfers.
Advise AI‑model training projects that rely on such pseudonymised data to argue that the processing falls outside the Regulation, strengthening the legitimate‑interest justification under Article 6(1)(f).
Update internal data‑inventory registers and subject‑access‑request procedures to reflect the reduced number of records subject to data‑subject rights, cutting administrative overhead.
Prepare evidential dossiers that document the technical safeguards preventing re‑identification, so that supervisory authorities cannot later re‑characterise the data as personal in enforcement actions.
For Law Students
The case illustrates how EU courts and institutions balance regulatory objectives with technological realities, applying a functional test rather than a formal definition. The core doctrinal distinction concerns the “identifiability” threshold embedded in the definition of personal data.
The decision is particularly relevant for the study of:
Data‑protection law and the scope of personal data
Pseudonymisation techniques and their legal effects
Legitimate‑interest balancing under Article 6
AI governance within the GDPR framework
The interaction between the Regulation and the Digital Services Act
Comparable cases include C‑311/18 Google Spain (2014) and C‑40/17 Planet49 (2019); contrasting them with this judgment highlights how the Court of Justice evaluates the practical ability to identify data subjects versus formal statutory language.
For Businesses
Marketing firms using contextual‑advertising measurement can now rely on the limited exemption, reducing the need to obtain explicit consent for each impression.
Healthcare providers processing pseudonymised patient data for research may lower compliance costs, provided they maintain documented proof that re‑identification is impossible.
FinTech companies handling pseudonymised transaction logs can streamline KYC and AML workflows, but must retain technical safeguards to prevent future de‑pseudonymisation.
Boards should commission a review of all pseudonymisation practices to confirm that the “cannot identify” threshold is met; failure to do so may expose the company to unexpected GDPR obligations.
Key Takeaways
Pseudonymised data are no longer personal data for a controller that cannot identify the individual, clarifying the Regulation’s scope.
Practitioners must adjust data‑classification regimes, DPIA requirements and contractual clauses to reflect the narrowed definition.
Supervisory authorities can no longer impose GDPR duties on such data unless they can demonstrate that re‑identification is feasible.
Watch the European Parliament’s upcoming vote on the Digital Services Act amendments, which may further refine the definition of pseudonymisation.
In‑house counsel should complete a compliance audit of all pseudonymised data sets before 1 January 2027 to ensure eligibility under the new scope.
Source: EU governments revise GDPR pseudonymized data rules in new digital package compromise
