Data Analysis not specified in protocol

Hello, I am hoping that someone can help clarify something for me. Sorry, there are a few questions.

If we have a study and we specify what data analyses we will do to assess our stated objectives. Let's say the data is collected, the stated analyses have been done, and the CSR is filed.

If the study team wants to look at the data after that analysis has been done (for learning that can help develop future products), that has to be considered secondary analysis, right?

Regarding secondary research, is the data considered to be de-identified if we (sponsor) only have study ID numbers /no identifying information) even if the site keeps a document linking the two?

Thought: is it possible to write a protocol objective that is general enough to allow analyses we don't know we want to do during the study?

Thank You.