It's Nothing Personal - Reassessing Pseudonymised Data And AI After EDPS v SRB

As organisations accelerate efforts to deploy AI, access to large volumes of training data has become essential to maintaining a competitive edge. But this raises a fundamental legal question; in the context of the GDPR, how far can businesses go when using datasets that appear de-identified or pseudonymised, particularly when training AI models?

On 4 September 2025, the Court of Justice of the European Union ("CJEU") issued its judgement in European Data Protection Supervisor ("EDPS") v Single Resolution Board ("SRB"), which introduces a potentially significant shift to how this question should be answered. It suggests that in some cases, certain pseudonymised data may fall outside the scope of the GDPR, depending on the recipient's perspective and who holds the means to re-identify the individuals concerned.