Fact · Voice privacy and security
Under the EU GDPR, personal data that has been pseudonymised still counts as information about an identifiable person when it can be attributed to that person with additional information.
Checked against its source on October 17, 2026
In the source's own words
“Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.”
Regulation (EU) 2016/679 (General Data Protection Regulation), recitals, Official Journal of the European Union (EUR-Lex), 2016, Recital 26.
Open the original- What it measures
- A recital explains how the GDPR's articles should be read. The same recital says that data which is truly anonymous, and no longer identifiable, falls outside the regulation.
- What it does not show
- A recital guides interpretation and does not itself impose duties. Whether any particular dataset is anonymous depends on the means reasonably likely to be used to identify people.