I was reading about the UK's upcoming GDPR implementation on the BBC earlier, and I assumed the ban on reidentification would apply to service providers and bus

I was reading about the UK's upcoming GDPR implementation on the BBC earlier, and I assumed the ban on reidentification would apply to service providers and businesses etc., and not to researchers or private individuals with legitimate intentions. Is this not the case?