Skip to main content
Praxikon

Legislation in motion

Proposal: implementing acts on when pseudonymised data ceases to be personal data (new Article 41a GDPR)

Date
Status
proposal
Body
Europese Commissie
Reference
COM(2025) 837 final, artikel 3, punt 10 (nieuw artikel 41a AVG); 2025/0360 (COD); ST 15698/25

What it is about

The Commission may adopt implementing acts specifying means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities. To do so, it must assess the state of the art and develop criteria or categories that controllers and recipients can use to assess the re-identification risk for typical recipients. Applying those means and criteria may be used as an element to demonstrate that the data cannot lead to re-identification. The EDPB is closely involved and has eight weeks to give an opinion on the draft. Adoption follows the examination procedure of Article 93(3). In Joint Opinion 2/2026 the EDPB and EDPS suggest deleting the article, because such an implementing act would de facto set the material scope of data protection law.

What this means in practice

If adopted, following the criteria of a Commission implementing act could serve as one element to demonstrate that your pseudonymised data cannot lead to re-identification. It is not conclusive proof, so you still need to document how you applied them. No such criteria exist today, and the Council Presidency compromise of June 2026 removes this power.

The GDPR articles concerned

Source: Raad van de EU, register (COM(2025) 837 final als ST 15698/25)checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law8 of 9

Guidelines8 of 10

Enforcement and fines

Legislation in motion6 of 17