If the unauthorised reversal of pseudonymisation is likely to result in high risks to the data subjects, the controller will need to communicate the nature of the data breach, and the further information stipulated in Art. 34(2) GDPR to the data subjects. If the controller is not in the position to communicate with the data subjects due to a lack of sufficient directly identifying information (even though pseudonymisation has been reversed), and other forms of communication (e.g., employing the services of a controller that possesses information sufficient for that purpose) would involve disproportionate effort, then the controller needs to notify by way of a public communication or similar equally effective measure. 17 See also the EDPB Guidelines 1/2022 on Data Subject Rights - Right of access, No. 45, 66 and the WP29 Guidelines on the right to data portability - endorsed by the EDPB, p. 11. 18 See Art. 14(2)(f) GDPR. 19 See also EDPB Guidelines 01/2021 on Examples regarding Data Breach Notification. 20 There is an obligation to document the breach pursuant to Art. 33(5) GDPR independent of the risk. Adopted - version for public consultation 20