Glossary · Glossary · GDPR concepts
Pseudonymisation: replacing identities without losing the thread
Anonimatum Team
In short
Pseudonymisation processes personal data so it can no longer be attributed to a person without additional information that is kept separately and protected. It is reversible, so pseudonymised data remains personal data.
Some documents lose their value if you simply black out names. A case-file review, a training set of judgments or a clinical study needs to know that person A on page 3 is the same person on page 40, without knowing who they are. That is what pseudonymisation is for.
Unlike anonymisation, pseudonymisation does not take data outside the UK or EU GDPR. It is a safeguard: it lowers risk, but whoever holds the key can undo it. Getting that distinction right avoids costly mistakes when publishing or sharing documents.
What Article 4(5) GDPR says
The GDPR defines pseudonymisation as processing personal data in such a way that it can no longer be attributed to a specific data subject without additional information, provided that information is kept separately and is subject to technical and organisational measures ensuring the data is not attributed to an identified or identifiable person. The UK GDPR uses the same definition.
There are two parts: the transformed data (the pseudonym) and the additional information that reverses it, such as a lookup table or a secret key. If that information sits next to the document or is open to anyone, there is no effective pseudonymisation, just relabelling.
Why it is still personal data
GDPR Recital 26 is explicit: pseudonymised data that could be attributed to a person using additional information should be treated as information on an identifiable person. For the organisation that keeps the table, every GDPR obligation still applies: lawful basis, transparency, individual rights and security. The ICO takes the same line in its pseudonymisation guidance.
There is a recent nuance in EU law. In Case C-413/23 P (EDPS v SRB, 4 September 2025), the Court of Justice accepted that pseudonymised data may not be personal data for a recipient with no reasonable means of re-identification. That does not help the controller who pseudonymised it: for them the data stays personal, and they must still tell individuals who the recipients are.
A safeguard the GDPR keeps mentioning
The GDPR does not impose a general duty to pseudonymise, but it names pseudonymisation as an example of an appropriate measure in several places:
- Article 25: data protection by design and by default.
- Article 32: security of processing, alongside encryption.
- Article 6(4): a factor when assessing whether further processing is compatible.
- Article 89: safeguards for archiving, scientific or historical research and statistics.
In January 2025 the European Data Protection Board adopted Guidelines 01/2025 on pseudonymisation as a version for public consultation. They introduce the pseudonymisation domain: the people or organisations from whom the pseudonym must prevent attribution. The choice of domain, and how well it is isolated from the additional information, largely decides how effective the measure is.
Pseudonymisation examples in documents
For documents, the most useful technique is consistent substitution: each person always receives the same pseudonym throughout the text, and across a batch if several files are processed together.
| Original text (fictitious) | Pseudonymised text |
|---|---|
| Ms Laura Bennett, National Insurance number QQ123456C | Ms PERSON_1, National Insurance number ID_1 |
| Ms Bennett stated that vehicle AB12 CDE… | Ms PERSON_1 stated that vehicle PLATE_1… |
| Her neighbour, David Shaw, confirmed… | Her neighbour, PERSON_2, confirmed… |
Other techniques include counters, random numbers and keyed hashing. A common mistake is unkeyed hashing of an ID number: because the format is known, every possible value can be hashed and matched. Remember too that indirect identifiers such as job titles, addresses and dates can still reveal the person after names are replaced.
Pseudonymising with Anonimatum
Anonimatum pseudonymisation detects personal data with its own AI on EU servers and replaces it consistently using profiles, for example a “Justice” profile for court decisions. The mapping is stored encrypted and lets you reverse the change when justified. To choose between the two techniques, see anonymise or pseudonymise.
Frequently asked questions
Is pseudonymisation the same as pseudonymization?
Yes. British English and EU texts use “pseudonymisation”; US texts often write “pseudonymization”. In US health law the closer concept is a re-identification code within de-identified data.
Can I publish a pseudonymised document?
With care. It remains personal data for whoever holds the key, and context may still identify people. For publication, anonymisation is the usual route.
Where should the additional information be kept?
Separately from the document, with restricted access, encryption and a log of who uses it.
Does pseudonymisation reduce GDPR obligations?
It reduces risk and can support a legitimate interests assessment or compatibility of purposes, but the GDPR still applies.
Pseudonymise documents with a reversible map
See the plans and start replacing personal data consistently across PDF, Word and Excel files, with mappings stored encrypted.