Pseudonymization:

The process of converting Personal Data into a form whereby it can no longer be attributed to a specific individual, without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.

Pseudonymization can generally be achieved by removing the association between an identifying data set and identities by de-identifying identifiers with reversible pseudonyms so that the data can be shared in de-identified form with one population of users while access to the identifying data can be maintained in a controlled manner for a restricted set of authorized users.

It is worth noting that pseudonymous data can have a strict legal definition in terms of compliance with a particular privacy standard. For example, GDPR requires both “technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”.

Return to glossary