Pseudonymization reduces the risk of re-identification and can support a Transfer Impact Assessment, but it never exempts the data exporter from the obligations set out in Chapter V of the GDPR. Since the CJEU ruling of 4 September 2025, everything hinges on a precise question: does the recipient have reasonable means to re-identify the data subject, yes or no? Without robust technical and contractual proof of this impossibility, pseudonymization remains a risk-reduction tool, not a legal carte blanche.
In brief:
- Pseudonymization strengthens the security of transfers by reducing re-identification risk, but does not exempt the exporter from GDPR compliance.
- The CJEU judgment of 4 September 2025 introduced a contextual assessment: pseudonymized data may be considered non-personal if the recipient cannot reasonably re-identify it.
- Companies must document precisely who holds the re-identification key, where it is stored, and under which jurisdiction, in their Transfer Impact Assessment (TIA).
- Pseudonymization must be accompanied by contractual, technical, and organizational safeguards-such as encryption and data separation-to be recognized as an effective measure.
- The re-identification assessment must be grounded in a precise analysis of the local legal framework and the recipient's capabilities, producing concrete evidence to demonstrate the reasonable impossibility of re-identification.
Table of contents
- What are the legal mechanisms for transferring data outside the EU?
- What is the legal status of pseudonymization after recent case law?
- How to integrate pseudonymization into the transfer impact assessment?
- What technical and organizational measures reduce the risk of re-identification?
- What pseudonymization really changes in daily practice
- How Safe-Doc facilitates pseudonymization before a transfer outside the EU
- Where to find reference texts and guides
- Sources
What are the legal mechanisms for transferring data outside the EU?
Chapter V of the GDPR sets out a straightforward principle: Article 44 prohibits by default any transfer of personal data to a third country unless one of the mechanisms provided for in the regulation applies. The objective is not to block international data flows, but to ensure that the level of protection remains equivalent once data leaves the European Economic Area, as the CNIL reminds us.
Three families of tools structure the practice:
- Adequacy decisions: when the European Commission recognizes that a country offers a comparable level of protection, the transfer may be carried out without additional formalities or TIA.
- Safeguards under Article 46: revised Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or ad hoc negotiated clauses. Each requires documenting the prior analysis and following the models published by the European Commission.
- Derogations under Article 49: explicit consent, performance of a contract, public interest. These require a strict necessity test and should only be used for one-off situations, never as the structural basis for recurring data flows.
In practice, many French companies transferring data to countries without an adequacy decision rely on SCCs. This is precisely where pseudonymization comes into play, because it reinforces a contractual safeguard that, on its own, is not always sufficient to neutralize the risk of access by foreign authorities.
What is the legal status of pseudonymization after recent case law?
Article 4(5) of the GDPR defines pseudonymization as processing that renders personal data non-attributable to an identified individual without the use of additional information, kept separately and protected by technical and organizational measures. This definition clearly distinguishes it from anonymization, which makes re-identification irreversibly impossible and removes the data from the scope of the GDPR. Pseudonymized data remains personal data as long as re-identification remains possible for someone, somewhere.
What the judgment of 4 September 2025 changes: the CJEU introduced a contextual rather than absolute approach. The same pseudonymized dataset may be classified as personal data for the exporter-who holds the re-identification key-and non-personal for the recipient, if the recipient has no reasonable means of accessing it. This principle was established in judgment C-413/23.
This reading fundamentally changes the way of reasoning. The data controller must now assess the status of the data from the perspective of each actor in the chain, rather than uniformly. The Court also recalls that the obligation to inform data subjects arises at the time of collection, regardless of the subsequent fate of the data.
Three operational consequences follow:
- The processing register must reflect this distinction in status between exporter and recipient, rather than a single "pseudonymized" checkbox.
- Information notices must cover the transfer outside the EU from the point of collection, even if the data is pseudonymized before sending.
- The residual risk of re-identification must be documented, not simply asserted.
The EDPB recommendations finally specify the conditions for pseudonymization to be recognized as an effective supplementary measure: strict separation of information enabling re-identification, reasonable impossibility for the authorities of the third country to access it, and contractual safeguards formally prohibiting any attempt at re-identification by the recipient.
How to integrate pseudonymization into the transfer impact assessment?
The Transfer Impact Assessment becomes mandatory whenever a transfer relies on an Article 46 tool and no adequacy decision covers the recipient country. It engages both the European exporter and the non-EU importer, who must provide information on their own legal framework and actual data-access practices.
The CNIL's practical guide offers a four-step method that most compliance teams can follow without heavy legal expertise:
1. Map the flow: identify precisely which categories of data are leaving the EU, to which country, and via which transfer tool.
2. Assess the local legal framework: verify whether the recipient country's legislation permits disproportionate access by public authorities.
3. Test the re-identification capability: determine whether the recipient, given their technical means and access to keys, could reasonably re-identify an individual.
4. Document supplementary measures: list what bridges the gap between the local level of protection and that required by the GDPR.
Pro tip: never treat pseudonymization as a checkbox in the TIA. Document precisely who holds the key, where it is stored, and under which jurisdiction-this is exactly what the EDPB and, now, the CJEU examine first.
The deliverables expected at the end of the process are concrete: a dated and versioned TIA report, a mitigation plan listing the technical and organizational measures adopted, annotated contracts specifying non-re-identification clauses, and the results of audits or penetration tests demonstrating that the safeguards hold in practice, not just on paper.
What technical and organizational measures reduce the risk of re-identification?
Effective pseudonymization does not rely on an algorithm alone, but on the overall architecture surrounding it. Here are the points that EDPB recommendations and CNIL guides consider foundational to withstand scrutiny.
On the technical side, three reflexes consistently recur in robust dossiers: encryption of mapping tables, physical or logical separation between pseudonymized data and information enabling re-identification, and storage of cryptographic keys exclusively within the European Economic Area. Salted hashing, combined with regular key rotation, seriously complicates any attempt at re-identification through cross-referencing.
On the governance side, the principle of least privilege is essential: only individuals with a genuine operational need access additional information. Fine-grained logging of such access, a documented key management policy, and regular penetration testing form the baseline expected by a regulator or external auditor.
The contractual clauses with the importer must go beyond standard SCCs: explicit prohibition of any attempt at re-identification, audit rights for the exporter, and obligation of immediate notification in the event of a breach affecting pseudonymized information. For health or biometric data, these safeguards must be reinforced, because the level of sensitivity requires protection beyond that of ordinary commercial data.
- Encryption of mapping tables and strict separation of datasets.
- Key storage in Europe, with scheduled rotation and salted hashing.
- Access limited, logged, and subject to periodic audit.
- Specific contractual clauses prohibiting re-identification by the importer.
Pro tip: for documents handled daily by your legal or finance teams, GDPR-compliant document pseudonymization deserves to be addressed upstream of the transfer, not as a last-minute step before export.
What pseudonymization really changes in daily practice
Most compliance dossiers treat pseudonymization as a technical formality, when in fact it is first and foremost a matter of proof. What the CJEU judgment of September 2025 clarified is that a company can no longer simply assert that its data is pseudonymized: it must demonstrate, with supporting documents, that the recipient has no reasonable means of re-identifying it.
At Safe-Doc, this requirement aligns directly with our product approach. The absence of document storage and strict separation of mapping keys facilitate demonstrating this impossibility of re-identification-whether for exchanges with subcontractors outside the EEA or for securing generative-AI use cases in the face of Shadow AI. But no technical tool, however robust, replaces the contracts and audit evidence that must accompany it.
- Jacques
How Safe-Doc facilitates pseudonymization before a transfer outside the EU
Documenting a convincing TIA means proving, not merely asserting, that the recipient cannot re-identify your data. Safe-Doc processes your documents in real time without durably storing them, automatically detects more than 90 types of sensitive data, and generates a mapping export that allows you to restore the original data only on your side.
Concretely, this covers situations compliance teams encounter every week: preparing a data room for a merger-acquisition operation, exchanging contracts with a subcontractor established outside the EEA, or securing the use of ChatGPT and Claude by your teams without exposing identifying information. Each processing generates an auditability report in PDF format-exactly the type of evidence a TIA or CNIL inspection requires. Legal departments and DPOs wishing to integrate these controls into their processes can explore Safe-Doc's DPO support and test the platform on a real use case before embedding it into their international transfer workflows.
Where to find reference texts and guides
To go further on the legal and technical aspects discussed here, several official sources remain essential for building a robust compliance dossier.
- The CNIL TIA guide details the complete methodology for transfer impact assessments.
- The EDPB recommendations 01/2020 specify the technical conditions for pseudonymization to be recognized as a supplementary measure.
- The EDPB guide for SMEs summarizes the obligations for organizations with limited legal resources.
- The European Commission standard contractual clauses models serve as the contractual basis for any transfer relying on Article 46.
- For companies structuring an international presence, a domiciliation solution like Adryo can complement this reflection on cross-border flows.
This article constitutes general information and does not replace the advice of a qualified attorney. Consult a qualified legal professional regarding your specific case before acting on this content.
Sources
- CNIL - European regulation: data protection
- EDPB - Recommendations 01/2020 (pseudonymization) - 2025 update
- Deshoulieres Avocats - Pseudonymization and personal data: what the CJEU ruling of 4 September 2025 changes
- European Commission - Standard contractual clauses (SCC)