Pseudonymization
Processing personal data so it cannot be attributed to an individual without additional separately-held information.
Definition
Pseudonymization is the processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures.
GDPR Definition: Article 4(5) formally defines pseudonymization. Unlike anonymization, pseudonymized data remains personal data because re-identification is possible with the separately-held key. However, pseudonymization is recognized as a valuable data protection measure.
Legal Status:
- Still personal data: GDPR applies to pseudonymized data
- Risk reduction: Recognized as safeguard under Articles 25, 32, 89
- Security measure: Appropriate technical measure for data protection
- Research exception: Facilitates GDPR Article 89 research derogations
Techniques:
- Tokenization (replacing identifiers with tokens)
- Hashing (one-way cryptographic functions)
- Encryption (reversible with key)
- Key-coding (replacing with random codes)
AI Applications: Pseudonymization is widely used in AI training data preparation. The EU AI Act's Article 10 data governance requirements can be partially addressed through proper pseudonymization of training data, reducing privacy risks while retaining data utility.
Distinction from Anonymization: Pseudonymization is reversible (with the key); anonymization is not. Pseudonymized data remains within GDPR scope; truly anonymized data does not.
Related concepts: Anonymization, De-identification, Data Protection, Data Governance
Sources
- •GDPR Article 4(5)
- •EDPB Guidelines
Related Terms
Anonymization
The irreversible process of altering data so individuals cannot be identified directly or indirectly....
De-identification
The process of removing or obscuring personal identifiers from data to protect individual privacy....
Data Governance
Policies, roles and processes that ensure data used across the AI lifecycle is fit for purpose, traceable, secure and managed in line with legal and operational requirements....