Pseudonimise

Pseudonimise is a verb describing the process of replacing or transforming personal identifiers in a dataset so that the data cannot be attributed to a specific individual without additional information. The transformation produces pseudonyms — consistent, reversible or partially reversible identifiers — that allow linkage within a dataset while reducing direct identifiability.

Techniques used to pseudonimise data include tokenization, keyed hashing, encryption, substitution, and controlled generalization. Effective pseudonymisation depends on secure key or mapping management; if the mapping or keys are compromised, the original identities can be restored. Because pseudonymised records can sometimes be re-identified by combining them with other data sources, pseudonymisation is distinct from anonymisation, which aims to make re-identification infeasible.

Pseudonymisation is commonly applied in research, healthcare, testing, analytics, and machine learning to balance data utility with privacy. It is often recommended as part of privacy-by-design practices and technical safeguards for data handling. In legal and regulatory contexts, jurisdictions such as the European Union recognise pseudonymisation as a risk-reduction measure (for example, under the GDPR), though pseudonymised data may still be treated as personal data if re-identification remains possible.

Limitations include residual re-identification risk, operational complexity in managing mappings and keys, and potential impacts on data quality and analysis. Decisions to pseudonimise should consider the threat landscape, intended uses of the data, and complementary safeguards such as access controls and auditing.