Article 1 (8) of Implementing Regulation to the PDPL
Removal of direct and indirect identifiers that indicate the identity of the Data Subject in a way that permanently makes it impossible to identify the Data Subject.
Anonymization is the process of removing any personally identifiable information from a data set so that you are no longer able to identify an individual in any way. As such, anonymized data is not considered personal data. Its use is not regulated by the PDPL.
Therefore:
1. The personal data which underwent anonymization is no longer subject to the PDPL.
2. The individuals cannot exercise the rights, as specified in the PDPL, in relation to the use of their anonymized personal data.
When done correctly, anonymization eliminates the data protection risks. This is because anonymized data cannot directly or indirectly identify the individual. Art. 9 of the Implementing Regulation to the PDPL specifies certain requirements for anonymization.
Please note, however, that the process of anonymizing personal data is still considered processing of personal data. Thus, it is subject to the scope and provisions of the PDPL.