Privacy
Pseudonymization
Processing personal data so it can no longer be attributed to a specific person without additional information kept separately.
Pseudonymization is a data protection technique where personal data is processed in such a manner that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately.
Key Characteristics
- The data remains personal data — it is not the same as anonymization
- A lookup key or table exists that can re-identify the individual
- The key must be stored separately with appropriate access controls
- Pseudonymized data is still subject to the GDPR
Examples
- Replacing names with random identifiers in a research dataset
- Using hashing to replace email addresses with hash values
- Replacing user IDs with pseudonyms in analytics
Legal Reference
GDPR Article 4(5). Encouraged by Articles 25 and 32.