pseudonymizing

Pseudonymizing is a data processing technique in which direct identifiers, such as names or contact details, are replaced with pseudonyms, tokens, or other placeholders. The link between the pseudonym and the original value is kept separately and secured, so re-identification is possible only by authorized parties under controlled conditions. This approach aims to reduce risk in data sharing while preserving analytical usefulness.

Pseudonymized data are not the same as anonymized data. Anonymization seeks to remove all reasonable means of identifying individuals; pseudonymization preserves a recoverable link to the person if the separate information is accessible. Consequently, pseudonymized data are generally still considered personal data under many privacy regimes and remain subject to data protection rules.

Common methods include tokenization, encryption with separate keys, and salted hashing. Tokenization substitutes identifiers with stable tokens; encryption transforms data with cryptographic keys; salted hashing reduces guessability. Each method involves trade-offs between re-identification risk and practical usability.

Applications span research, analytics, and regulated data sharing in sectors like healthcare and finance, where organizations want to minimize exposure while retaining the ability to link records when legitimate purposes arise. Pseudonymization is often part of privacy-by-design and risk-management programs, complemented by strict access control, key management, and data governance.

Regulatory context: under the GDPR, pseudonymization is a technique that replaces identifying parts with pseudonyms and stores the separating information separately. It can reduce privacy risk but does not eliminate the data's status as personal data.