The Court of Justice of the European Union, in its judgment of 4 September 2025 (Case C-413/23P), ruled that pseudonymised data can be considered anonymous for the recipient if they are not able to identify the data subjects.

The case originated from the resolution of Banco Popular Español S.A. and the transmission of pseudonymised data to a third-party company via a secure server, for the purpose of assessing the rights of shareholders and creditors—a transmission of which these individuals had not been informed. The European Data Protection Supervisor (EDPS) challenged the lack of such information, considering the data to still be personal. However, the General Court of the EU upheld the appeal brought by the Single Resolution Board (SRB), classifying the data in question as anonymous, since the third party could not realistically identify the individuals concerned.

 The EDPS appealed the decision, bringing the matter before the CJEU, which confirmed that data is considered personal only if it relates to an identified or identifiable individual, and that pseudonymisation does not automatically render data personal. Therefore, while pseudonymised data remains personal data for the controller who performed the pseudonymisation, it may be regarded as anonymous for other parties if, in light of the specific circumstances, the pseudonymisation effectively prevents those parties from identifying the data subjects, even when using additional information.