Pseudonymisation

Pseudonymisation, defined in Article 4(5) of the GDPR, means processing personal data so that it can no longer be attributed to a particular individual without additional information, where that additional information is kept separately and protected so the link cannot casually be made again. Swapping a customer name and email address for a reference, and holding the mapping in a different system with its own access controls, is the ordinary example. The data is still about a person. What has changed is how much work it takes to establish which person.

Pseudonymised data remains personal data, and every obligation in the regulation continues to apply to it. Anonymised data is different in kind: where no one can single out an individual by any means reasonably likely to be used, the information is no longer personal data and the GDPR does not govern it at all. That threshold is far harder to reach than teams assume, because a handful of quasi-identifiers such as a postcode, a date of birth and a precise timestamp will often identify somebody uniquely long after the obvious fields have been stripped out.

Why it is worth doing anyway

• The regulation names it as an appropriate technical measure, so it counts towards security of processing and towards data protection by design.
• It shrinks the consequences of a breach. An exposed table of references without its mapping is a materially smaller incident than an exposed table of names and addresses.
• It is the practical route to building test and analytics environments that behave like production without carrying real identities into them.
• It supports separation of duties, since a team can work productively with the data while having no way to see whose data it is.

Calling a dataset anonymised does not make it anonymous: if you or anyone else can reverse the mapping, it is pseudonymised, and it is still personal data.