The CJEU judgment C-413/23 P explained: pseudonymised data and the relative approach

Last updated : 2026-10-11

For whoever holds the mapping table, yes; for a recipient who cannot reasonably re-identify, no: this is the relative approach adopted by the CJEU on 4 September 2025.

This is not legal advice. This page explains a judgment for a non-lawyer audience. It sticks to what the Court wrote and does not engage your professional liability. For a decision on a real file, consult your professional body or a qualified lawyer.

The facts

In June 2017, the Single Resolution Board (SRB) put the bank Banco Popular Español into resolution (paragraphs 10 to 12). The shareholders and creditors concerned could submit comments on the draft decision on their compensation. Each comment was tied to a code, which allowed the SRB to link it to its author. A subset of 1,104 comments was sent to Deloitte for a valuation (paragraphs 17 to 28).

The information given to participants did not name Deloitte among the possible recipients. Five complaints led the European Data Protection Supervisor (EDPS) to find a breach of Article 15(1)(d) of Regulation 2018/1725, which requires telling people who receives their data (paragraphs 29 to 34). On 26 April 2023, the General Court of the European Union annulled that decision (case T-557/20), holding that the comments sent to Deloitte were not personal data (paragraphs 35 to 38).

The question put to the Court

The EDPS, supported by the European Data Protection Board, lodged an appeal (paragraphs 39 to 42). Two questions matter for this page. Does a comment that expresses a person’s opinion relate to that person? And does pseudonymised data remain personal data for a recipient who does not hold the information needed to re-identify the person?

The Court’s answer

The judgment of 4 September 2025 (First Chamber, ECLI:EU:C:2025:645) sets aside the General Court’s judgment. Here is what it says, point by point.

  • Opinions relate to a person. A personal opinion or view is linked to its author, with no need to look for a particular content, purpose or effect. The General Court erred on this point (paragraphs 54 to 61).
  • The status depends on an assessment. Applying the regulation presupposes an assessment of whether the person is identified or identifiable (paragraph 69). Pseudonymisation is not part of the definition of personal data (paragraph 72). It presupposes that additional information exists which allows re-identification (paragraph 73).
  • For whoever holds the key, the data stays personal. The SRB held the additional information allowing the comments to be attributed to their authors (paragraph 76).
  • For the recipient, it may differ. According to paragraph 77, the comments sent to Deloitte may not be personal data for Deloitte, on two conditions: it cannot lift the pseudonymisation measures during its own processing, and those measures actually prevent it from attributing the comments to the person, including through cross-referencing.
  • The general rule. Pseudonymised data must not be regarded as personal data “in all cases and for every person” (paragraph 86; the Court’s French text reads « en toute hypothèse et pour toute personne »). If the recipient can reasonably attribute the data to a person, for example by cross-referencing it with other data it holds, the person remains identifiable for that recipient (paragraph 85). The concept of personal data is broad but not unlimited (paragraph 88).
  • The duty to inform is assessed differently. For the duty to inform about recipients, the Court holds that identifiability is assessed at the time of collection and from the controller’s point of view (paragraph 111). That duty applies before any transfer, whether or not the recipient can identify the people (paragraphs 112 to 115). The General Court therefore erred by requiring Deloitte’s point of view.
  • What happens next. The case is referred back to the General Court, which must rule on the second plea of the original action, which requires factual assessments (paragraphs 121 and 122). The Court itself therefore did not rule that the comments were non-personal for Deloitte.

Advocate General Dean Spielmann delivered his opinion on 6 February 2025 (ECLI:EU:C:2025:59). He already proposed setting aside the General Court’s judgment and referring the case back, distinguishing the relative assessment of pseudonymised data from the controller’s point of view for the duty to inform.

What this changes for a professional who sends a pseudonymised prompt

Take a solo lawyer, a self-employed physician or an accountant who replaces names with markers such as {{PERSON_a1b2}} before sending a text to a language model provider, and who keeps the mapping table on their own machine.

  • For you, the data stays personal. You hold the mapping table, like the SRB in the judgment (paragraph 76). The GDPR still applies to your processing, and ndaact.ai’s local processing is described as client-side pseudonymisation (Article 4(5) GDPR).
  • For the provider, the question differs. If it receives only markers, without the table, and has no reasonable means of attributing the text to a person, the Court’s relative approach supports arguing that this data is not personal for it. That qualification is assessed case by case, under the conditions of paragraph 77. We speak of de-identification toward the third party, not of anonymisation of the prompt.
  • Your duty to inform remains. Paragraph 111 places the duty to inform about recipients on the controller’s side, at the time of collection. A professional who collects client data therefore cannot conclude from the judgment that naming the model provider has become unnecessary.
  • The judgment’s scope is narrow. It interprets Regulation 2018/1725, which applies to EU institutions. The Court ties its reading to the GDPR concept of personal data, but the case is not about a language model. Transposing it to your practice is an analysis to carry out with your adviser.

Limits

  • Indirect identifiers. Paragraph 77 concerns measures that prevent attribution, including through cross-referencing. A sentence such as “my client, the only organic baker in the village” can identify a person although no name appears in the text.
  • Detection can miss entities. ndaact.ai replaces the entities it detects. An undetected entity reaches the model provider in clear, with the rest of the text, and markers cover only what was detected.
  • What the provider can cross-reference. Paragraph 85 concerns a recipient that holds other data. A file’s context, dates or amounts can be enough to re-identify a person if the provider holds other information.
  • This judgment does not validate a tool. It mentions neither ndaact.ai nor any product, and it exempts no one from any obligation. It describes how the Court assesses whether pseudonymised data is personal.

The texts

Source: CJEU, EDPS v SRB, C-413/23 P, 4 September 2025.

This page is a translation. The French version prevails.