Skip to content
cyberGDPR

06 · Art. 4(5) · 32(1)(a) · Area

Pseudonymisation & encryption

Pseudonymisation and encryption are the only two measures Art. 32 names explicitly, and encryption can even lift the duty to inform people after a breach. This area explains the difference with anonymisation, keyed hashing and tokenisation, key management, and why a plain hash of an email address protects nothing.

  1. Pseudonymisation vs Encryption Under the GDPR

    Pseudonymisation and encryption under GDPR explained for engineers: Article 4(5), Recital 26, HMAC keyed hashing, tokenisation, key management and pitfalls.