Glossary
Pseudonymisation
Processing personal data so it can no longer be attributed to a person without additional information kept separately and protected (Art. 4(5)).
Article 4(5) GDPR defines pseudonymisation as the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures ensuring non-attribution. Recital 26 is explicit that pseudonymised data remains personal data, and Recital 28 notes that pseudonymisation can reduce risks to data subjects.
The GDPR names pseudonymisation in Article 32(1)(a) as an example of an appropriate security measure and in Article 25(1) as a data protection by design measure. EDPB Guidelines 01/2025 on pseudonymisation stress that the secret or mapping table must be kept separate from the pseudonymised dataset.
For engineers, the technique matters. Plain unsalted hashes of email addresses, phone numbers or IDs can be reversed by enumeration or dictionary attack, so they are weak pseudonymisation. Keyed hashing (HMAC with a secret key held separately) or tokenisation with a protected vault are stronger options. See our guide to pseudonymisation vs encryption for patterns and pitfalls.