Pseudonymisation reduces regulatory obligations. What does it actually provide, and where is it commonly overstated?

What it provides

Identifiers are replaced with pseudonyms and the mapping is held separately under stronger control. A breach of the pseudonymised store does not directly disclose identities, and access to the behavioural data can be granted more widely than access to the mapping.

It is a genuine and valuable risk reduction, and it is a recognised safeguard.

Where it is overstated

Pseudonymised data is still personal data. The mapping exists, so re-identification is possible, and the obligations largely still apply — subject rights, purpose limitation, transfer rules. Teams frequently treat pseudonymisation as though it were anonymisation and conclude the rules no longer bind them.

Anonymisation is a much higher bar: re-identification must be impossible by any reasonably likely means, for anyone, including by combining with other datasets. Removing identifiers does not achieve it — quasi identifiers like postcode, date of birth and a rare attribute re-identify individuals in a surprisingly small population.

And hashing an identifier is not anonymisation. For an enumerable space such as email addresses or phone numbers, a deterministic hash can be reversed by testing candidates.

What determines the strength of the safeguard

• Where the mapping key lives and who can reach it — the entire benefit rests on this separation.
• Whether the pseudonym is deterministic, which allows joins and analysis and simultaneously enables correlation across datasets that partly undoes the protection.
• The richness of the retained data, since re-identification risk rises with the number of attributes regardless of the identifier treatment.
• Whether both stores are reachable by the same people, in which case the separation is organisational fiction.

The honest position

Use it as a risk reduction, not as an exemption. Where the objective is genuinely to leave the regulatory scope, the requirement is anonymisation assessed against a stated re-identification threshold, and that assessment usually finds the data less anonymous than expected.