Who should access data and what does pseudonymisation do?

Access should match the user’s task and permissions. Pseudonymisation and masking can reduce exposure, but pseudonymous data can still be personal data. Data protection requires an appropriate combination of access control, security, purpose limitation and retention rules.

Related glossary: GDPR, Transparency