What is pseudonymisation?
Pseudonymisation is processing personal data so that it can no longer be linked to a specific person without additional information kept separately.
A common example is replacing names and personal identity numbers with a code. The key to the code is kept elsewhere, protected from those working with the data.
For whoever holds the key, pseudonymised data is still personal data under the GDPR, because it can be linked back.
It still reduces the risk and is one of the safeguards the regulation highlights. It can be a good step before data is used for analysis or testing.
How it works
There are several ways to do it. Identifying details can be replaced with random codes, with codes derived using a secret key or with sequence numbers held in a separate table. What matters is that the link back is kept apart and protected, both technically and through who has access.
Why it matters
Pseudonymisation lets you work with data more safely. Whoever analyses or tests rarely needs to know who the data is about. If something goes wrong, the harm is smaller. GDPR mentions pseudonymisation both as part of data protection by design and as a security measure.
What to keep in mind
Free text needs extra care. Names, addresses and other details can sit in the middle of a note and slip past a simple replacement.
The EU Court of Justice has confirmed that the assessment can differ between parties. For a recipient who cannot reasonably identify the people, the data is not necessarily personal data. For whoever holds the key, it is.
What it means for you
See pseudonymisation as one safeguard among several. The GDPR rules still apply.
Common questions
Is pseudonymised data still personal data?
Yes, for anyone who can link it back using the additional information. For them, GDPR applies in full.
How is it different from anonymisation?
Pseudonymisation can be reversed with the right key. Anonymisation cannot, and truly anonymous data falls outside GDPR.
Does pseudonymisation help when we use AI?
Yes. It reduces the risk if data ends up in the wrong place, and GDPR names pseudonymisation as an appropriate safeguard.
Sources: GDPR, Article 4, on EUR-LexEDPB Guidelines 01/2025 on pseudonymisationJudgment in Case C-413/23 P on EUR-Lex
Related terms
Read more
All terms Updated