Additional information used for pseudonymisation is kept separately or deleted; pseudonymised data is protected by an internal management plan, access logs and other technical, physical and administrative measures; companies may ask the FSC (or the data agency it delegates to) to review anonymisation, which is then presumed non-identifying; pseudonymised data is not processed to identify individuals for profit or improper purposes; if individuals become identifiable, the data is withdrawn, processing stops and the identifying data is deleted at once; and records of pseudonymisation and anonymisation (date, items, reason and basis) are kept three years. Most subject-rights articles do not apply to pseudonymised data (Article 40-3).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.