Deterministic Tokenisation
Replacing a sensitive value with a stable surrogate so the same input always yields the same token, preserving joins while removing the value.
Random tokenisation removes the value and removes the ability to join — two datasets tokenised independently no longer match on customer. Deterministic tokenisation preserves the match: the same email always becomes the same token, so analysis that counts distinct customers or joins across systems still works without the underlying identifiers being present.
The property that makes it useful is exactly the property that limits its protective value. A stable one-to-one mapping preserves frequency and distribution, so it is vulnerable to inference — the most common token in a retail dataset is the most frequent shopper, and correlating with any external information can re-identify. Deterministic tokens are therefore pseudonymisation rather than anonymisation, and the data remains personal data under most regimes, with all the obligations that follow.
The design decisions that matter: keep the token mapping in a separate store with its own access control, so holding the tokenised dataset conveys nothing; use a keyed function so tokens can be rotated if the key is compromised; and decide the scope of determinism — global tokens maximise joinability and maximise inference risk, per-dataset tokens invert both.