Pseudonymisation of Patient Data in Case Reports: What GDPR, the EDPB Guidelines and German Law Mean for Authors

Case reports describe individual patients in detail, often with rare conditions, images and a precise timeline. That makes them valuable to clinicians and, at the same time, a re-identification risk. Under the GDPR, the difference between anonymisation and pseudonymisation decides whether published patient data are still personal data [1].

This article focuses on pseudonymisation: what the EDPB guidelines say it can and cannot achieve, how it fits the drafting of a case report, and what German authors add on top of the GDPR. It is general information, not legal advice. For the full evidence on consent rates, images and the identifier checklist, read our companion guide to anonymisation vs pseudonymisation of patient data in case reports.

Article 4(5) of the GDPR defines pseudonymisation as processing personal data so that they can no longer be attributed to a specific person without additional information, which is kept separately and protected. Recital 26 places anonymous information, where the person is not or no longer identifiable by means reasonably likely to be used, outside the Regulation [1, 3].

On 16 January 2025 the European Data Protection Board adopted Guidelines 01/2025 on pseudonymisation for public consultation [2]. They treat it as a risk-reduction measure, not a route out of data protection law. The points most relevant to authors:

• Pseudonymised data remain personal data for anyone who can re-attribute them using the additional information.
• It supports other GDPR duties, such as data protection by design, data minimisation and security.
• Its effect depends on context. The guidelines define a “pseudonymisation domain”: the people who should only ever see the coded data.
• The key must be protected by technical and organisational measures that prevent unauthorised re-identification.

Two later developments sharpen the picture. In EDPS v SRB (C-413/23 P, 4 September 2025) the Court of Justice held that pseudonymised data are not necessarily personal data for a recipient who cannot re-identify the person by means reasonably likely to be used, although the controller’s obligations remain [5]. In July 2026 the EDPB adopted draft Guidelines 02/2026 on anonymisation for consultation, which also apply a context-dependent test [6].

Removing a name does not make a case report anonymous. The Article 29 Working Party named three re-identification risks: singling out, linkability and inference [3]. In case reports they usually come from:

• a rare diagnosis combined with age, sex and region;
• exact dates of admission, surgery or death;
• hospital names, occupations or unusual life events;
• clinical images showing faces, tattoos, jewellery or other distinctive features;
• social media or local news coverage of the same event.

Because health data are a special category under Article 9 of the GDPR, the consequences of re-identification are serious for the patient [1]. For editing workflows that handle such data, see our guide to GDPR Article 9 and patient data in manuscript editing.

Combine pseudonymisation, data minimisation, de-identification and informed consent [1, 4]:

1. Pseudonymise working files: replace identifiers with codes and store the key separately, inside the clinical team.
2. Minimise: include only the details the clinical lesson needs.
3. Generalise: use relative time (“day 3”) and age ranges, and remove locations.
4. Review images: crop, mask or remove identifying features and strip metadata.
5. Obtain written consent: ICMJE expects written informed consent where identifying information is essential, and the patient should be shown the manuscript [4].
6. Test the result: ask a colleague whether someone who knows the patient could recognise them.

Never send the key or the source records to the journal. Our case report submission package lists what the journal does need.

German authors apply the GDPR together with the Federal Data Protection Act (BDSG). Section 22 BDSG governs the processing of special categories of personal data, such as health data, and section 27 covers processing for scientific research purposes, including safeguards such as pseudonymisation [7]. Hospitals are also bound by state hospital and data protection laws, and by their own policies, which differ between federal states.

In practice, involve the hospital’s data protection officer early, especially for rare conditions or images, and keep a written record of the de-identification steps and the consent [2, 4].

Pseudonymisation is a valuable safeguard while a case report is being prepared, but under the GDPR and the EDPB guidelines it does not make patient data anonymous for the team that holds the key. For publication, combine data minimisation, careful anonymisation of details and images, and documented informed consent, so the clinical lesson is shared without exposing the patient. The ten stages from consent to print are mapped in our case report workflow.