CIPP/E: Certified Information Privacy Professional/Europe

GDPR Article 2(2)(c) excludes processing performed by a natural person in the course of a purely personal or household activity. The Regulation can still cover non-automated data in a filing system, pseudonymised personal data, and storage of personal data.

GDPR Recital 26 provides that the Regulation does not apply to anonymous information, including personal data anonymized so that the data subject is no longer identifiable. Pseudonymization, encryption, and masking can preserve the ability to identify or re-identify a person and therefore do not by themselves take data outside GDPR scope.

Compatibility of further processing depends on the original collection context and the relationship with the data subjects, as well as the proposed new purpose and its effects. The GDPR also requires the controller to inform data subjects of a new purpose before further processing where applicable. Therefore, the students’ existing notices and the intended research use must be established.

GDPR personal data includes information relating to an identified or identifiable natural person, including identification numbers. Unlinked aggregated statistical data do not relate to an identified or identifiable individual; as anonymous information, they are outside the GDPR’s personal-data scope.

Under GDPR Article 20(2), direct controller-to-controller transmission is required only where it is technically feasible. The GDPR encourages interoperable formats but does not require controllers to adopt or maintain technically compatible systems; providing the portable data in structured, commonly used, machine-readable formats satisfies the separate portability requirement.