The recent decision of the Court of Justice of the European Union (CJEU) in the Russmedia Digital case upended the traditional understanding of the measures required of online marketplaces to comply with their data protection duties under the GDPR. The new obligations that the CJEU introduced around policing illegal content will likely be both costly and difficult to implement. At the same time, the decision also eliminated an exemption from liability for companies that breach their obligations to protect sensitive data posted on their websites. This article examines the decision and offers practical compliance measures that companies can take in response, with insights from Europe-based partners at Bird & Bird, Ropes & Gray, Steptoe and Van Bael & Bellis. See “New Duties Around Pseudonymized Data After E.U. Court Decision” (Oct. 15, 2025).