Category: Privacy-Enhancing Techniques

Pseudonymisation

Also known as: Pseudonymization

Simply put

Pseudonymisation is a technique that replaces, removes, or transforms the details that directly identify a person in a data record, while keeping the information needed to re-identify them stored separately. Because that additional information still exists and could be used to link the data back to an individual, pseudonymised data is generally still treated as personal data. It reduces risk but does not make the data anonymous.

Formal definition

Pseudonymisation refers to a set of data protection and de-identification measures by which identifying fields within a data record are replaced, removed, or transformed such that the data can no longer be attributed to a specific data subject without the use of separately held additional information. Under the UK GDPR and EU GDPR framing (see ICO guidance and Recital 28), that additional information must be kept separate and subject to technical and organisational measures to prevent re-identification. Critically, pseudonymised data remains personal data and stays within the scope of data protection law, because the re-identification is reversible where the additional information is available. This distinguishes it from anonymisation, which aims to render re-identification irreversible and generally places the resulting data outside the scope of most data protection regulation. Applying pseudonymisation can help controllers and processors reduce risk to data subjects and support their data protection obligations, but it does not by itself guarantee compliance, and its adequacy depends on context, implementation, and the effectiveness of the controls protecting the separated information. This entry does not address cross-border transfer mechanics, retention rules, specific lawful bases for processing, or enforcement penalties, and treatment of these concepts may differ across jurisdictions and instruments such as the CCPA/CPRA, HIPAA, or ISO/IEC 27701.

Why it matters

Pseudonymisation matters because it is one of the most frequently misunderstood techniques in data protection practice. A common and consequential mistake is to treat pseudonymised data as if it were anonymous and therefore outside the scope of data protection law. Under the UK GDPR and EU GDPR framing (see ICO guidance and Recital 28), pseudonymised data generally remains personal data, because the additional information needed to re-identify individuals still exists and could be used to link records back to a specific person. Any organisation that treats pseudonymised datasets as unregulated risks applying inadequate safeguards to information that remains within scope.

Applied correctly, pseudonymisation can reduce the risks to data subjects and help controllers and processors meet their data protection obligations, as reflected in the EU GDPR recitals. It supports a risk-reduction posture by limiting who can directly identify individuals from a working dataset and by keeping the re-identifying information under separate technical and organisational controls. This makes it a useful measure in contexts such as analytics, testing, and internal data sharing where working with directly identifying fields is unnecessary.

However, pseudonymisation does not by itself guarantee compliance, and its adequacy depends on context, implementation, and how effectively the separated additional information is protected. Because re-identification is reversible where that additional information is available, weak controls over the separated data can undermine the protection entirely. This entry does not address cross-border transfer mechanics, retention rules, lawful bases for processing, or enforcement penalties, and treatment of pseudonymisation differs across instruments such as the CCPA/CPRA, HIPAA, and ISO/IEC 27701.

Who it's relevant to

Data protection officers and privacy leads

DPOs and privacy leads need to ensure their organisations treat pseudonymised data as personal data that remains within the scope of data protection law under the UK GDPR and EU GDPR framing, rather than mistaking it for anonymised data. They are typically responsible for confirming that the additional re-identifying information is held separately and protected by adequate technical and organisational measures, and for cautioning stakeholders that pseudonymisation reduces risk but does not by itself guarantee compliance.

Privacy engineers and data architects

Those designing data pipelines and systems implement the actual replacement, removal, or transformation of identifying fields and the separation of the additional information needed for re-identification. Their design choices determine whether the separated information is genuinely protected, which directly affects whether the pseudonymisation meaningfully reduces re-identification risk in a given context.

Controllers and processors handling personal data

Both controllers and processors can apply pseudonymisation to reduce the risks to data subjects and help meet their data protection obligations, as reflected in the EU GDPR recitals. They should recognise, however, that the adequacy of pseudonymisation depends on context and implementation, and that the resulting data remains personal data subject to applicable obligations.

Compliance and information governance professionals

These professionals rely on a clear distinction between pseudonymisation and anonymisation when classifying datasets and defining how they may be used or shared. Misclassifying pseudonymised data as anonymous can lead to insufficient safeguards being applied to information that is still in scope, so accurate categorisation and demonstrable evidence of the protecting controls are important.

Inside Pseudonymisation

Reversibility

Pseudonymisation is a reversible technique in which data can be re-attributed to a specific individual through the use of additional information, distinguishing it fundamentally from anonymisation, which is intended to be irreversible.

Additional information kept separately

The identifiers required to reverse the process (for example, a key or mapping table) must be kept separate from the pseudonymised data and subject to technical and organisational measures to prevent re-attribution to an identified or identifiable person.

Retained status as personal data

Under the EU GDPR and UK GDPR, pseudonymised data generally remains personal data because re-identification is possible using the separately held additional information, and therefore data protection obligations continue to apply.

Technical and organisational measure

Pseudonymisation is typically treated as a safeguard or risk-reduction measure rather than a means of taking data out of scope, and it can support obligations such as data protection by design and security of processing.

Relationship to security controls

Pseudonymisation intersects with information security (protecting the separation of the additional information) and with governance (documenting the technique, its scope, and accountability), without eliminating the underlying data protection duties.

Common questions

Answers to the questions practitioners most commonly ask about Pseudonymisation.

Does pseudonymising personal data mean it is no longer personal data and falls outside data protection law?

No. Pseudonymisation is a reversible technique in which identifiers are replaced but the mapping to identify individuals still exists, typically held separately. Because re-identification remains possible using that additional information, pseudonymised data is generally still treated as personal data and remains in scope of frameworks such as the EU GDPR and UK GDPR. This contrasts with anonymisation, which aims to be irreversible and, where genuinely achieved, is typically considered out of scope for most such regulation.

If I encrypt or tokenise the data, isn't that the same as anonymising it?

Not in a compliance sense. Encryption and tokenisation are generally regarded as forms of pseudonymisation rather than anonymisation, because the original data can be recovered using a key or a token vault. The ability to reverse the process means the individuals remain identifiable to the party holding that additional information, so the data typically continues to qualify as personal data. Describing encrypted or tokenised data as non-personal is a common expert-level mistake.

Where should the additional information used to re-identify individuals be kept?

Generally, the additional information that permits re-identification should be kept separately from the pseudonymised dataset and subject to technical and organisational controls that restrict who can bring the two together. Separating the mapping and limiting access is central to the concept, though the specific arrangements depend on context and implementation. This entry does not prescribe particular tooling or key-management architectures.

What obligations continue to apply once data has been pseudonymised?

Because pseudonymised data typically remains personal data, obligations that apply to personal data generally continue to apply, including having a lawful basis for processing and honouring applicable data subject rights, subject to any conditions in the relevant regime. Pseudonymisation may be relevant as a technical and organisational measure, but it does not by itself remove these obligations. This entry does not cover retention rules, cross-border transfer mechanics, or the treatment of special category data in detail.

Can pseudonymisation help demonstrate compliance or reduce risk?

Pseudonymisation is often recognised as a technical and organisational measure that can support data protection objectives and reduce certain risks. However, it does not guarantee compliance; whether it is adequate depends on the jurisdiction, the processing context, the residual re-identification risk, and how it is implemented alongside other controls. Under accountability-oriented frameworks, its use generally needs to be evidenced rather than merely asserted.

How does the choice between pseudonymisation and anonymisation affect scope?

The practical difference lies in reversibility. Pseudonymisation retains a path to re-identification and therefore generally keeps the data within regulatory scope, whereas anonymisation, if genuinely achieved so that individuals are no longer identifiable, is typically out of scope for most data protection regulation. Because achieving true anonymisation is difficult and context-dependent, teams should assess residual re-identification risk rather than assume a label removes obligations. This entry does not set thresholds for when anonymisation is considered achieved.

Common misconceptions

Pseudonymisation and anonymisation are interchangeable terms.

They are distinct. Pseudonymisation is reversible and the resulting data generally remains personal data subject to regulation, whereas anonymisation is intended to be irreversible and, where genuinely achieved, typically falls outside the scope of most data protection regimes.

Pseudonymising data (for example through encryption or tokenization) makes it non-personal and removes it from regulatory scope.

Because re-identification remains possible using the separately held additional information, pseudonymised data generally continues to be treated as personal data under the EU GDPR and UK GDPR, and applicable obligations still apply.

Applying pseudonymisation guarantees compliance or discharges data protection obligations.

Pseudonymisation is a risk-reduction safeguard, not a compliance guarantee. Whether it is adequate depends on context, jurisdiction, and implementation, and it must be supported by demonstrable governance and security measures rather than stated intent alone.

Best practices

Keep the additional information needed to reverse pseudonymisation (keys, mapping tables) physically or logically separate from the pseudonymised data, and apply access controls to prevent re-attribution.

Continue to treat pseudonymised data as personal data for the purposes of the EU GDPR and UK GDPR, and confirm the position in any other applicable regime rather than assuming uniform treatment.

Document the pseudonymisation technique, its scope, and the roles accountable for managing the separated additional information, so that accountability can be evidenced rather than merely asserted.

Do not rely on pseudonymisation, encryption, or tokenization alone as a means of taking data out of regulatory scope or as a standalone guarantee of compliance.

Assess whether pseudonymisation is adequate for the specific processing context and risk profile, recognising that its sufficiency depends on jurisdiction and implementation.

Coordinate the security controls protecting the additional information with governance documentation, so that both the confidentiality of the separation and the policy basis for the technique are maintained.