Pseudonymization.

A technique that replaces direct identifiers in personal data with reversible aliases, so that the data can no longer be attributed to an individual without additional, separately kept information. It belongs to the Privacy & Data Protection category of cybersecurity.

A technique that replaces direct identifiers in personal data with reversible aliases, so that the data can no longer be attributed to an individual without additional, separately kept information.

Pseudonymization is defined in GDPR Article 4(5) as the processing of personal data so that it can no longer be attributed to a specific data subject without the use of additional information, which must be kept separately and protected. Typical methods include deterministic tokens, HMAC with a secret key, format-preserving encryption, and lookup tables held in a key vault. Unlike anonymization, pseudonymized data remains personal data under GDPR and ISO/IEC 27559, but qualifies as an explicit safeguard (Articles 25 and 32) that reduces re-identification risk and breach impact. It is widely used in analytics, ML training, fraud cooperation, and clinical research, paired with strict key management and access controls.

Defences for Pseudonymization typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Pseudonymisation, Reversible De-identification.