Pseudonymisation

The distinction from anonymisation is legal as well as technical, and getting it wrong is a common and consequential error. Anonymised data falls outside data protection law entirely, because re-identification is not reasonably possible. Pseudonymised data remains personal data and remains fully in scope, because the mapping exists somewhere and can be reversed.

Teams routinely believe they have anonymised when they have pseudonymised — replacing a name with a customer identifier, or hashing an email address. A hash is a pseudonym, not an anonymisation: the input space of email addresses is small enough to brute force, so an unsalted hash is reversible in practice, and a salted one is still a stable pseudonym linking every record for that person.

The benefit is nonetheless substantial and recognised in law as a risk-reducing measure: it limits what a breach exposes, it supports minimisation, and it enables analytics on data that cannot be casually linked back to individuals.

The control that determines whether it means anything is separation of the mapping table — held in a different system, under different access control, so that the population able to re-identify is small and audited. Pseudonymised data sitting in the same database as the lookup that reverses it has achieved a naming convention rather than a security boundary.

The harder truth underneath: true anonymisation of rich behavioural data is very difficult, because uniqueness in high-dimensional data makes re-identification through combination surprisingly easy.