What is pseudonymization, and why is it not the same as anonymization?

Pseudonymization replaces identifying data with artificial identifiers (pseudonyms) using a mapping rule — but it's reversible, which means the data is still personal data under data protection law.

How pseudonymization works:

1. Take the original dataset with real names
2. Replace each name with a pseudonym (e.g., a hash value)
3. Store the mapping (correspondence table) separately and securely
4. The pseudonymized dataset can be used for analysis without directly exposing identities

Example:

Critical distinction from anonymization:

Important: Even without the key, the remaining quasi-identifiers in a pseudonymized dataset (ZIP code, age, gender) might allow re-identification through linkage attacks. Simply replacing names with hashes does not make data anonymous.

Go deeper:

• Pseudonymization (Wikipedia) — GDPR Art. 4(5), reversibility and why it stays personal data.