Precedent corpus / EDPB (European Data Protection Board)
European Data Protection Board
EDPB (European Data Protection Board) case GL-01-2025, decided 2025-01-16. No monetary penalty (reprimand or guidance).
Regulator guidance (positive exemplar)
What the regulator decided
Pseudonymised data which could be attributed to an individual by the use of additional information remains information relating to an identifiable natural person and is therefore personal data within the meaning of Article 4(1) GDPR. Pseudonymisation can support Article 5, Article 25 and Article 32 compliance but does not, by itself, take the data outside the GDPR's material scope.
Primary source
Regulator-owned URL. Quote this in legal briefs and academic citations.
https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdfConsentMark interpretation
Operator-readable note on how this case shapes the ConsentMark scanner narrative. Not a legal opinion; cites the primary source.
[Type: guidance] Non-enforcement guideline (public consultation draft). Cite when the scanner narrative covers a controller arguing that a hashed-email join key or pseudonymous device-ID is not personal data - the EDPB's position is unambiguously that pseudonymous data is personal data so long as re-identification is reasonably feasible. Companion to DPC Apple IN-20-39-1.
Verification trail
- Verified by
- donal
- Verified at
- 2026-05-27
- Review due
- 2026-11-27
Cite this case
Pick the format that matches where you are pasting. The methodology version is preserved in every variant so the citation stays verifiable after future methodology changes.
@misc{consentmark-precedent-edpb-gl-01-2025,
author = {{ConsentMark}},
year = {2025},
title = {EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board},
howpublished = {\url{https://www.consentmark.com/precedent/edpb-gl-01-2025}},
note = {ConsentMark methodology v1.3}
}ConsentMark. (2025, January 16). EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board. Methodology v1.3. https://www.consentmark.com/precedent/edpb-gl-01-2025[EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board - ConsentMark](https://www.consentmark.com/precedent/edpb-gl-01-2025)EDPB (European Data Protection Board) GL-01-2025 - European Data Protection Board - ConsentMark, 2025-01-16, methodology v1.3, https://www.consentmark.com/precedent/edpb-gl-01-2025