GDPR Art. 11 EN

Processing which does not require identification

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation.¶

Identification Personal Data Controllers 68
2.

Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification.¶

Identification Personal Data Controllers 82

Enforcement

Cited in 7 fines totalling €106K

Top authority: 🇪🇺Hellenic Data Protection Authority (HDPA) (6) · median fine €15,000 · see all enforcement for Art. 11 →

Connections by provision

11(1) 42 Case Law 8 Enforcement 18 Guidance .md

Case Law 42

European Commission v Hungary Safe Interenvios, SA v Liberbank, SA and Others CJEU Bara: national law cannot excuse controller's duty to inform data subjects of X v Russmedia Digital SRL and Inform Media Press SRL Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 CJEU - C-473/12 - IPI +34 more

Enforcement 8

Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service One Way Private Company: Insufficient technical and organisational measures to ensure information security EDPB - Binding Decision 1/2026 ¶10 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶25 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶19 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶18 Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service ¶10 EDPB - Binding Decision 1/2026

Guidance 18

EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Guidelines 01/2022 on data subject rights - Right of access Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Study on the secondary use of personal data in the context of scientific research Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( +10 more

11(2) 20 Case Law 16 Enforcement 44 Guidance 2 Literature .md

Case Law 20

Criminal proceedings against V.S HelHO - HelHO:2026:8 Austrian Federal Administrative Court: address publisher's data transfer and Article 15 CJEU Bara: national law cannot excuse controller's duty to inform data subjects of Österreichische Datenschutzbehörde v F R RW v Österreichische Post AG European Commission v Hungary CJEU - C-205/21 - Ministerstvo na vatreshnite raboti +12 more

Enforcement 16

Datatilsynet reprimands Danish Tax Administration for access request delays (2019-2024) Finnish DPA: requesting address, ID number and strong authentication for access request HDPA (Greece) - 54/2024 EDPB - Binding Decision 1/2026 CNIL (France) - SAN-2022-011 NAIH (Hungary) - NAIH-11443-3/2026 ¶8 EDPB - Binding Decision 1/2026 ¶28 CNIL (France) - SAN-2022-011 +8 more

Guidance 44

Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan Guidelines 01/2022 on data subject rights - Right of access Guidelines 03/2021 on the application of Article 65(1)(a) GDPR Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidelines 02/2022 on the application of Article 60 GDPR EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) +36 more

Literature 2

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Generative AI and data protection