Pseudonymisation in clinical research and real-world data: keys, roles and risk

Clinical research runs on data that identifies people: medical records, discharge letters, lab results, imaging. Increasingly it also runs on real-world data reused from routine care for observational studies, registries and post-marketing evidence. The technique that lets researchers work with that information without exposing patients, while keeping a controlled way back to them when needed, is pseudonymisation.

One point needs to be clear from the start: pseudonymised data is still personal data under both the EU GDPR and the UK GDPR (Article 4(5) and Recital 26). What changes is the level of risk. The ICO's guidance makes the same point and adds a useful nuance: if pseudonymised data is shared without the additional information, it may be effectively anonymous in the recipient's hands, but it remains personal data for whoever holds the key. The European Data Protection Board's Guidelines 01/2025 on pseudonymisation take a similar risk-based view.

Pseudonymisation is not anonymisation

Trials and cohort studies usually need pseudonymisation rather than anonymisation: visits must be linked over time, adverse events reported back to the site, and incidental findings communicated to the patient. Our glossary entry on pseudonymisation covers the concept in more depth.

The legal frame in the UK, the EU and the US

• UK: since the Data (Use and Access) Act 2025, research safeguards sit in a new Chapter 8A of the UK GDPR (Articles 84A to 84C, fully in force since February 2026). Article 84C requires technical and organisational measures for data minimisation, naming pseudonymisation as an example, and rules out processing likely to cause substantial damage or distress or used for decisions about an individual (except approved medical research). For confidential patient information in England and Wales, the common law duty of confidentiality still applies; where consent is impracticable, researchers can seek support under section 251 of the NHS Act 2006 through the Confidentiality Advisory Group run by the Health Research Authority.
• EU: the GDPR (Articles 9(2)(j) and 89), Regulation (EU) 536/2014 on clinical trials and, for secondary use at European scale, the European Health Data Space Regulation (EU) 2025/327, which applies in stages. Member states add their own rules: Spain, for instance, requires technical and functional separation between researchers and whoever holds the re-identification key.
• US: HIPAA does not use the term pseudonymisation. Data is either de-identified under the Safe Harbor method (removal of 18 listed identifiers) or Expert Determination, or it remains protected health information. A covered entity may keep a re-identification code, but only if it is not derived from information about the individual and the mechanism for re-identification is not disclosed (45 CFR 164.514(c)).

The coding key and separation of duties

In practice, pseudonymisation splits the data into two parts: the research dataset, carrying a code instead of identity, and the additional information (a lookup table or a cryptographic key) that can reverse it. Everything depends on who holds that second part.

• Key custodian: a function separate from the research team, such as a trusted research environment, a hospital data unit or an independent third party.
• Meaningless codes: random tokens or keyed cryptographic functions. Avoid initials plus date of birth, or a truncated hospital number. The ICO specifically warns against unkeyed or outdated hashing such as MD5 and SHA-1.
• Domain-specific pseudonyms: the same patient can receive different codes in different studies, so datasets cannot be linked without going through the custodian.
• Access control and logging: the key is encrypted, access is restricted, and every re-identification is recorded with its reason.
• A documented re-identification route for legitimate cases, such as returning a clinically significant finding to the treating team.

Where re-identification creeps back in

Replacing a name with a code is the easy part. The real risk sits in quasi-identifiers and, above all, in free text.

Risk should be assessed on the whole dataset the researcher receives and on what they could reasonably link it with, not document by document. See our glossary entry on re-identification.

Protocol checklist

Pseudonymising clinical documents with Anonimatum

Much real-world data arrives as documents: discharge summaries, scanned records, referral letters, case report forms. Anonimatum supports consistent pseudonymisation: each patient, clinician or site receives the same substitute throughout the document and, with the same project identifier, across the study's documents. Dates can be shifted by the same number of days across the project to preserve intervals, and the equivalence map is stored encrypted, so only its custodian can reverse the change. That fits the separation of duties: the unit that pseudonymises keeps the map, and researchers receive only the transformed documents.

Detection combines in-house AI (names, addresses, dates, organisations) with patterns for emails, phone numbers and similar identifiers, and you can add custom patterns for a hospital number or local patient ID. Scans are processed with OCR, and everything runs on servers in the European Union without sending text to external language-model APIs. Learn more about anonymising medical records.