Data Protection

Pseudonymization

Processing personal data so it cannot be attributed to an individual without additional separately-held information.

Definition

Pseudonymization is the processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures.

GDPR Definition: Article 4(5) formally defines pseudonymization. Unlike anonymization, pseudonymized data remains personal data because re-identification is possible with the separately-held key. However, pseudonymization is recognized as a valuable data protection measure.

Legal Status:

  • Still personal data: GDPR applies to pseudonymized data
  • Risk reduction: Recognized as safeguard under Articles 25, 32, 89
  • Security measure: Appropriate technical measure for data protection
  • Research exception: Facilitates GDPR Article 89 research derogations

Techniques:

  • Tokenization (replacing identifiers with tokens)
  • Hashing (one-way cryptographic functions)
  • Encryption (reversible with key)
  • Key-coding (replacing with random codes)

AI Applications: Pseudonymization is widely used in AI training data preparation. The EU AI Act's Article 10 data governance requirements can be partially addressed through proper pseudonymization of training data, reducing privacy risks while retaining data utility.

Distinction from Anonymization: Pseudonymization is reversible (with the key); anonymization is not. Pseudonymized data remains within GDPR scope; truly anonymized data does not.

Related concepts: Anonymization, De-identification, Data Protection, Data Governance

Sources

  • GDPR Article 4(5)
  • EDPB Guidelines