Pseudonymization in data processing is permissible if what conditions are met?

• A. Contractual and technical controls are in place.
• B. Only encryption exists.
• C. Data is stored in a public cloud.
• D. No privacy requirements apply.

Answer: (A)

Pseudonymization reduces identifiability by replacing direct identifiers with codes, but the data can still be linked to a person if additional information is available. To be permissible, this processing requires safeguards that both govern who can access the data and how it’s handled, and technical measures that protect the data and the linking information.

Having contractual controls in place ensures clear roles and responsibilities with any processors, including requirements for data protection and handling of the pseudonymized data. Technical controls cover access restrictions, separation of data from the keys that would re-identify it, strong key management, and security measures such as encryption where appropriate. Together, these controls minimize the risk of re-identification and align with data protection expectations, making pseudonymization acceptable.

Relying on encryption alone misses governance and operational safeguards; storing data in a public cloud isn’t inherently disqualifying but doesn’t by itself ensure proper protection; and privacy requirements typically apply to personal data, so claiming no privacy requirements apply isn’t correct.