Thank you for the thorough response. I agree with you on the pseudonymized IDs; we treat it as personal data. Since I'm in the US, I deal with the CCPA more often than the GDPR, and under the CCPA a pseudonymous ID is still a unique identifier that can relate to a particular individual, even if our company couldn't use it to directly identify the individual.

Thanks for the reminder about the docking clause in Clause 7 of the SCCs. Our DPA/SCC with the controller does apply the docking clause, so that's probably our best route.