---
title: "Case C-413/23 P: judgment of 4 September 2025"
canonical: "https://dposchool.com/gdpr/case/c-413-23-p"
source: "https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en"
source_note: "Only the judgment as published by the Court of Justice is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Court of Justice judgment · Case C-413/23 P

# European Data Protection Supervisor v Single Resolution Board

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Case:** C-413/23 P
- **Court:** Court of Justice
- **Date of judgment:** 4 September 2025
- **ECLI:** ECLI:EU:C:2025:645
- **Instrument:** Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR)
- **Provisions:** [Article 4(1)](https://dposchool.com/gdpr/article/4#4-1), [Article 4(5)](https://dposchool.com/gdpr/article/4#4-5), [Article 13](https://dposchool.com/gdpr/article/13), [Article 14](https://dposchool.com/gdpr/article/14)

Listed under "Related (earlier law or other instruments)": this judgment concerns earlier law or another instrument, not the GDPR alone.

## Holding (summary, not the official text)

On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back.

## Official source

- [Case C-413/23 P on CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en)
- [Judgment on EUR-Lex (CELEX 62023CJ0413)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413)

Checked against the official source on 28 October 2026.

Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Judgments](https://dposchool.com/gdpr/cases) / C-413/23 P

[All judgments](https://dposchool.com/gdpr/cases)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents