Pseudonymization

Pseudonymization separates direct identifiers from the data record while retaining a controlled means of linkage. A name, address, or account number may be replaced with a random token, and the correspondence between token and identity is stored in additional information protected by technical and organizational measures.¹

The technique supports secondary uses such as research, statistical analysis, testing, fraud detection, and service administration. Because records can still be linked across events, pseudonymization often preserves longitudinal value that would be lost through irreversible anonymization. It is therefore a risk-reduction measure rather than a promise that individuals cannot be identified. The strength of the protection depends on the token-generation method, access controls, separation of duties, and the other datasets available to an attacker.

Pseudonymization differs from anonymization because it retains a means of re-attributing data to an individual. Under the General Data Protection Regulation (GDPR), pseudonymized information that could be attributed using additional information is still personal data, whereas genuinely anonymized information falls outside the regulation’s personal-data rules.¹

The boundary is practical rather than merely technical: an organization must consider reasonably likely means of identification, including singling out, linkage with other datasets, and inference. Removing names alone is rarely sufficient, because combinations such as dates, locations, diagnoses, or rare characteristics may identify a person. Guidance from European and United Kingdom privacy authorities consequently treats pseudonymization as one control within a broader risk assessment, not as a substitute for data minimization or access governance.

Effective pseudonymization uses identifiers designed for a defined purpose and protects the re-identification mechanism as a separate asset. Common approaches include random substitution tables, keyed cryptographic tokens, and cryptographic hashing with a secret key; plain unsalted hashes are often unsuitable because predictable identifiers can be guessed or searched.

Safeguards typically include separate storage of the lookup table, encryption in transit and at rest, narrowly assigned access rights, key rotation, audit logging, retention limits, and independent administration of identity and analytical environments. A token should not reveal the original value or be reused across unrelated purposes when reuse would enable unwanted linkage. NIST describes pseudonymization as a privacy-enhancing technique whose design must account for linkage, disclosure, and operational context rather than relying on a single algorithm.² Standards work also emphasizes documented threat models and controlled re-identification procedures.³

Pseudonymization can protect both data subjects and data operations, but its residual risks are frequently underestimated. A stable token can become a persistent identifier, allowing a profile to be assembled across systems even when the person’s name is hidden. Small populations, unusual medical conditions, precise timestamps, and geolocation can also make records distinctive enough for re-identification through external information.

Re-identification may nevertheless be legitimate in tightly defined circumstances, such as correcting a clinical record, responding to a data-subject request, or investigating data quality. Such access should be exceptional, logged, authorized, and separated from routine analysis. In research, pseudonymization may enable a trusted party to reconnect participants for follow-up while limiting investigators’ access to identities. The technique does not remove duties concerning lawful purpose, transparency, retention, security, or individual rights; those obligations generally continue for as long as the data remains personal data.¹

Additional information

Information, such as a lookup table or secret key, that can connect a pseudonymized record to an identifiable person.

Anonymization

Processing intended to make identification impossible or not reasonably likely, so that the resulting information is no longer personal data.

Direct identifier

A value such as a name, email address, or government identifier that identifies a person without requiring linkage to another dataset.

Linkability

The ability to connect records belonging to the same person, even when the person’s direct identity is concealed.