Pseudonymisation
Safeguard under Art. 4(5) + Art. 32 GDPR
TL;DR
Pseudonymisation under Art. 4(5) GDPR is the processing of Personal Data in such a way that the data can no longer be attributed to a specific person without the use of additional information — provided that such additional information is kept separately.
What is Pseudonymisation?
Important: pseudonymised data remains Personal Data — the GDPR continues to apply. Anonymisation, by contrast, renders data non-personal (the GDPR does not apply), but requires irreversibility.
EDPB Guidelines 01/2025 on Pseudonymisation: concrete recommendations on hashing, encryption and token-based Pseudonymisation. Separation of keys and data is recommended.
Practical example
Practical examples:
- Employee personnel number instead of the name in performance reports
- Hash-based cookie tracking instead of direct attribution to an email address
- Test database with faker tools instead of live data
- Token-based patient IDs in research databases
Frequently asked questions
Pseudonymisation = anonymisation?
No. Pseudonymisation is reversible (with the key), whereas anonymisation must be irreversible. The EDPB scrutinises claims of anonymisation strictly.
Is Pseudonymisation sufficient as a technical and organisational measure under Art. 32?
Pseudonymisation is expressly named as a safeguard (Art. 32(1)(a)). However, it is not sufficient for particularly sensitive processing operations — additional encryption is recommended.
When is Pseudonymisation mandatory?
Implicitly for high-risk processing (Art. 35 DPIA obligation) and for research (Art. 89). Supervisory authority recommendation: as standard in test environments.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are a compliance specialist, not a law firm. For legally binding information, consult a qualified lawyer.