Saudi Arabia PDPL IR-9: Anonymisation that makes re-identification impossible

What does IR-9 require?

A Controller anonymising data ensures re-identification is impossible, assesses the impact including re-identification risk where an impact assessment is triggered, takes measures reflecting technological developments and anonymisation methods, and evaluates and adjusts technique effectiveness; anonymised data is not personal data (IR 9). Pseudonymisation keeps additional information separate under controls (IR 1).