A research unit replaces names with codes but keeps the key, then c…

Question

A research unit replaces names with codes but keeps the key, then calls the file “anonymous open data.” Which label is correct under GDPR?

Accepted Answer

Presence of a re-identification key means the coded dataset is typically pseudonymised personal data still within GDPR scope, not anonymous open data. — If the decoder ring still sits in the drawer, the costumes are not true anonymity. Codes plus a retained key equal classic pseudonymisation—still personal data under GDPR. Renaming the folder “anonymous open data” does not finish the magic trick.

Answer

Keeping a re-identification key always converts the dataset into anonymous data outside GDPR.

Answer

Coded research files are exempt from GDPR whenever the word “open data” appears in a filename.

Answer

Pseudonymisation removes all controller obligations including security and purpose limitation.

A research unit replaces names with codes but keeps the key, then calls the file “anonymous open data.” Which label is correct under GDPR?

Short Explanation

Full Explanation