Re-Identification Risk
The probability that pseudonymised data can be linked back to individuals, which is what keeps such data within the scope of data protection law.
Replacing a name with a token removes the direct identifier and leaves everything else. Whether the result identifies someone depends on what remains and what else exists in the world.
The mechanisms are well established. Quasi-identifier combination: postcode, date of birth and sex jointly identify a large proportion of a population, without any name being present. Linkage: joining the pseudonymised set against a public or purchased dataset that shares attributes. Uniqueness in the tail: a rare attribute value — an unusual job title, a rare condition, a very high transaction amount — is identifying on its own. Frequency preservation, which deterministic tokenisation retains by design, so the most common token corresponds to the most frequent individual.
Because the risk is non-zero, pseudonymised data remains personal data under most regimes and carries the full set of obligations. Anonymised data — where re-identification is not reasonably possible — falls outside, which is a materially different position and is correspondingly hard to reach.
The practical implication for design: treat pseudonymisation as a risk-reduction control rather than as an exemption, and do not build a compliance argument on the assumption that tokenised data is out of scope.