Pseudonymisation may be employed as one of several measures contributing to a level of security appropriate to the risk of the data processing activity, in accordance with Art. 32(1) GDPR. Pseudonymisation may lower the severity of the consequences of unauthorised access to data. No one in the pseudonymisation domain, who accesses the pseudonymised data without authorisation, should be able to easily use the data to the disadvantage of the data subject, unless they also manage to (illegitimately) access the relevant additional information needed for attribution. Controllers and processors still have to provide a level of security appropriate to the remaining risks involved in the processing of the pseudonymised data. For processors this includes, as per Art. 28(1) GDPR, providing sufficient guarantees that appropriate technical and 12 For example, Italian law mandates pseudonymisation in the course of the processing of genetic and judiciary data. 13 Cf. Article 29 Working Party, Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, p42-43 . 14 See also Recital 50 GDPR for further context. Adopted - version for public consultation 16 organisational measures to ensure this level of security are implemented. The use of pseudonymisation for reducing security risks is illustrated in Example 6 in the Annex.