Under the GDPR, organizations within a given sector or representative body can develop Codes of Conduct to help overcome key data protection challenges. Developing an approved Code is a serious endeavour and difficult to achieve, but can be of great benefit, including by better enabling responsible international data sharing in genomics and health-related research. Such Codes complement rather than supersede the GDPR.

The GDPR now explicitly mentions, and even defines, pseudonymisation, namely the processing of personal data so they can no longer be attributed to a specific data subject without the use of additional information (provided certain measures are in place to prevent re-identification). Coding is commonly used in health research and can, in some cases, act as a pseudonymisation technique. The question arises as to whether pseudonymised data are no longer personal data and hence no longer subject to the GDPR.