Is pseudonymised data personal data under GDPR in Ireland?

Is pseudonymised data personal data? For the firm that swapped the names out and kept the original, yes. For whoever receives the coded version, the Court of Justice gave a narrower answer in September 2025. How the term sits beside de-identified and anonymised is in our guide to those three words.

The question has stopped being academic. Somebody in an Irish office takes a paragraph from a file, replaces the client’s name and PPS number, and pastes the rest into a chatbot. Whether that number was the only thing to worry about is answered in is a PPSN personal data.

Who holds the lookup table decides whether it is personal data

Recital 26 says coded data that could be attributed with additional information “should be considered” personal. The Court of Justice read it as relative: not personal “in all cases and for every person” (EDPS v SRB, paragraph 86). The provider’s desk worries me most; which AI tools meet the GDPR in Ireland compares the plans.

Article 4(5) GDPR and the Data Protection Act 2018 definition

Article 4(5) has three parts: data processed so it can no longer be tied to a specific person without additional information; that information kept separately; and protected by technical and organisational measures. Section 69 of the Data Protection Act 2018 repeats the definition for Part 5, the law enforcement rules.

Drop one part and you hold a copy with some words changed. A code list sitting on a hidden tab of the same workbook fails “kept separately” before anyone tries to read it. I don’t let the word into a privacy notice for a file kept like that.

In Irish law the word works mostly as a safeguard: section 36(1)(e)(iv) lists it among the suitable and specific measures, as with special category data in an Irish workplace.

Anonymised or only coded? The DPC’s difference, with an example

The DPC’s guidance note is dated June 2019, and on 7 November 2026 the linked copy still carried that date, with no word on SRB. Pseudonymisation, in its terms, swaps identifying details for a value that does not identify anyone directly, and it warns the protection is limited because indirect routes still work.

Anonymisation has to stop three things: singling one person out, linking records and inferring facts about someone. Done irreversibly, the data is no longer personal and the GDPR stops applying. The same invented claims record, treated both ways with the note’s own techniques, shows the gap better than a definition does.

The middle column is still about Pádraic for anyone holding the lookup table, and possibly for anyone who knows Ennistymon. I trust the right-hand column only once the original is gone, because the DPC says a version kept beside its source may be just pseudonymised.

That matching risk is sharper with chatbots than with spreadsheets, because chats are kept. Google holds Gemini conversations picked for human review for up to three years, and a consistent label makes them easy to string together.

EDPS v SRB, C-413/23 P: when coded data stops being personal for the recipient

After Banco Popular Español was resolved, the Single Resolution Board coded comments from shareholders and creditors and sent them to Deloitte. The European Data Protection Supervisor found that people should have been told Deloitte would receive them.

The Court of Justice ruled on 4 September 2025, and the case went no further. It was under Regulation 2018/1725, which binds EU bodies, but paragraph 52 says personal data is read the same way there and in the GDPR. I wouldn’t sign off an Irish privacy notice now without this judgment open beside it.

Paragraph 81, which summaries skip, recalls that a press release naming nobody can still identify someone once combined with what is online. A provider’s logs sit beside a vast amount of other text, and what ChatGPT keeps on each plan decides how long yours stays to be matched.

Coded prompts in ChatGPT, Claude and Copilot: personal data for the provider?

If the substitution happens on your computer and the table linking each label to its value stays there, the provider has nothing to reverse, and the first condition of paragraph 77 can be met. That part is architecture, and software can settle it.

The second condition depends on who the provider is to you. On a consumer account it judges from its own position, and I wouldn’t bet a client’s file on it passing.

EDPB guidelines on anonymisation: where the drafts stand on 7 November 2026

Two EDPB texts sit around the judgment, and neither is final. The pseudonymisation draft predates SRB: its paragraph 22 treats coded data as personal whenever the pieces could be combined by means reasonably likely to be used, even with different people holding each.

The 2026 anonymisation draft cites SRB and judges from each entity’s own perspective. The Commission’s Digital Omnibus would write that relative reading into the GDPR, but it is still in committee in Parliament.

Until final texts land, I’d write office rules to the stricter 2025 draft and put them in the firm’s AI policy, where people will actually look.

How the CSO and Irish health researchers handle coded data

The CSO’s Health Research Data Centre removes names, addresses and dates of birth and links records by a Protected Identifier Key kept inside the CSO. It still calls the result “safe, pseudonymised, personal data”.

The Health Research Consent Declaration Committee agrees in its FAQs: coded data is personal data and the Health Research Regulations apply. Chart reviews in a practice are covered in our guide to patient data and AI.

For me this is the Irish yardstick: the State codes data and still treats it as personal, behind several locks. A paste with the names swapped has one lock, at best.

Identifiable without a name: testing a client paragraph

Here is an invented note a small practice might ask a chatbot to turn into a letter, with a typical swap, not any particular tool’s output.

One credit union in a small Leitrim village has one assistant manager. WRC hearings have been held in public since 29 July 2021, and decisions name the parties unless the adjudication officer finds special circumstances. A published decision with the same dates is exactly the other data paragraph 85 means.

The Court asks whether you can rule identification out, not whether the provider will go looking. So a list of what to redact can’t stop at names and numbers.

The version I’d send: an assistant manager at a small financial institution, long service, dismissed this year after raising a concern, hearing pending. Accountants meet the same problem in a client’s payroll query.

Estate agencies meet it in a sale-agreed note with the townland and price left in, the case AI for Irish estate agents is built around.

Article 28, legal privilege and breach rules still apply to coded text

The EDPB’s 2025 draft credits coding with the help listed below; other duties ignore it. The notice that goes with your engagement letter still has to name the provider as a recipient, whatever was swapped.

Practice Direction HC 142, in operation in the High Court since 1 September 2026, says: “Privileged information entered into non-private GenAI Tools or systems may lose its privileged status.” What a deponent declares under HC 142 is a separate duty.

That turns on where the text went, not on names, so I count coding as a weak plank in any privilege argument. Our page for solicitors sets out the Law Society’s side.

If someone reverses a coded file without authority, check whether it is a notifiable breach before the 72 hours run.

Before a coded passage leaves the office

SRB swaps “did I take the names out” for a sharper question: who could tell who this is, and holding what? Nonimo answers the part software can. It is an app for Mac and Windows: select a passage, press one key, and names and numbers become labels on your own computer.

That happens before the text reaches ChatGPT, Claude or Copilot, and your originals go back into the reply you copy. The label list never leaves your machine, as our security page explains, so in law the text stays personal data for you.

What it cannot judge is the credit union in Drumcullig. My rule of thumb: if someone local would know who it is, assume the provider could too, and rewrite. Nonimo for Irish firms shows the app on an Irish document, if you want to try that on your next letter.

Sources

• Court of Justice, EDPS v SRB, C-413/23 P, 4 September 2025. Paragraphs 52 to 112.
• European Data Protection Board, Guidelines 02/2026 on Anonymisation, version 1.0, adopted 7 July 2026. Paragraph 15 and Example 4. Guidelines 01/2025 on Pseudonymisation, version 1, paragraphs 22 and 23 and footnote 21, are on the same site.
• Data Protection Commission, Guidance Note on Anonymisation and Pseudonymisation, June 2019.
• Data Protection Act 2018, section 36. Suitable and specific measures; sections 42 and 69 on the same site.
• Law Society Gazette, CJEU ruling knock-on for subject-access requests, 14 October 2025. The access-request point on opinions.
• Health Research Regulations 2018, S.I. No. 314 of 2018. Regulation 3(1)(b)(vi).
• Central Statistics Office, Health Research Data Centre FAQ. Protected Identifier Key, output checks, approvals.
• Health Research Consent Declaration Committee, frequently asked questions. FAQs 1 and 6: coded data is personal data.
• High Court, Practice Direction HC 142, 29 July 2026. Paragraph 10(5) on privilege.
• Workplace Relations Commission, Workplace Relations (Miscellaneous Provisions) Act 2021 guidance. Public hearings from 29 July 2021.
• GDPR, Article 4(5) and Recitals 26, 75 and 85; General Court order of 19 December 2025, T-557/20 RENV; Digital Omnibus, COM(2025) 837, procedure 2025/0360(COD).

Checked on 7 November 2026.