The General Data Protection Regulation (GDPR) applies to the processing of 'personal data,' defined as any information relating to an identified or identifiable natural person. According to Recital 26 of the GDPR, the principles of data protection do not apply to anonymous information. Data is considered anonymous if it has been processed in such a manner that the data subject is not or is no longer identifiable. Consequently, since anonymized data does not relate to an identifiable person, it falls outside the material scope of the GDPR. The other techniques listed are security measures applied to personal data, but they do not remove the data from the Regulation's scope.

A. Pseudonymized: This data is still considered personal data under the GDPR because it can be re-identified using additional information. It is a security measure, not a method of de-identification.
C. Encrypted: Encryption is a security measure to protect personal data. The data remains personal data because it can be decrypted with the appropriate key, thus re-identifying the individual.
D. Masked: Data masking is a technique to obscure data, but it is still considered personal data as the original data exists or the individual may still be identifiable.

1. Regulation (EU) 2016/679 (General Data Protection Regulation).

Recital 26: "The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information..."

Article 4(5): Defines 'pseudonymisation' as a process where personal data can still be attributed to a data subject through the use of additional information, confirming it remains within the scope of personal data.

2. Article 29 Data Protection Working Party, "Opinion 05/2014 on Anonymisation Techniques," WP216, 10 April 2014.

Page 6, Section II.A: "Once data are truly anonymised and the data subjects are no longer identifiable, the data protection principles no longer apply to them... In contrast, pseudonymisation is a useful security measure, but it is not a method of anonymisation." This document, foundational to the EDPB's current guidance, explicitly separates anonymization (out of scope) from pseudonymization (in scope).

3. Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer.

Page 15, Section 2.2.2: "The GDPR does not apply to data that has been anonymized. Data is anonymized if it does not relate to an identified or identifiable natural person or if it has been rendered anonymous in such a way that the data subject is not or no longer identifiable (Recital 26 GDPR)."