What is pseudonymization?
Pseudonymization is a de-identification technique that replaces the details pointing directly at a person, such as a name, email address or medical record number, with an artificial identifier. The link between each pseudonym and the real person is kept separately, under its own access controls. Someone holding only the pseudonymized data can't tell who a record describes, while someone holding both pieces can reverse it. The EU's GDPR defines the term in Article 4(5) and names it as a safeguard in its rules on data protection by design, security of processing and research. It is also spelled pseudonymisation.
How pseudonyms are generated
- Random IDs with a lookup table: each person gets a random value, and the table mapping values to people is stored apart from the data.
- Keyed hashing: an HMAC of the identifier with a secret key gives the same pseudonym every time, so records can be joined across data sets without a table.
- Encryption: the identifier is encrypted, and only the key holder can decrypt it.
- Tokenization: a token vault issues stand-in values and holds the mapping.
A plain, unkeyed hash of an email address or phone number is a weak pseudonym. Anyone can hash a list of likely values and match them, so the method that was supposed to hide identities is effectively public.
Example: a clinical study
| Hospital record | What the research sponsor receives |
|---|---|
| Ana Ruiz, MRN 448812, born 1981-03-14 | Subject S-0193, born 1981 |
| HbA1c 7.9% on 2026-09-02 | HbA1c 7.9%, study week 12 |
The hospital keeps the list linking S-0193 to the patient, so its clinicians can contact her if a result needs follow-up. The sponsor analyzes the data without names. The birth date and test date were also coarsened, because pseudonymization on its own leaves quasi-identifiers such as birth dates and postal codes in place, and those can identify people when combined.
Why pseudonymized data is still personal data
Because the original identities can be restored, GDPR treats pseudonymized data as personal data for any organization able to re-identify it, and all the regulation's duties still apply. Pseudonymization still reduces risk: a leak of the research data set alone exposes no names, and a leak of the key table alone exposes no health data. Whether the same data counts as personal data for a recipient with no realistic means of re-identifying anyone is a narrower legal question that depends on the circumstances. Keeping the key apart is the whole point, so store it in a different system with different administrators and log every lookup.
Pseudonymization vs. anonymization, masking and encryption
- Anonymization: meant to be irreversible for everyone, so truly anonymous data falls outside GDPR. Pseudonymization is reversible by design.
- Data masking: hides or replaces values, often to show part of a number or to build test data, and usually isn't meant to be reversed.
- Encryption: protects the whole value or file; pseudonymization targets the identifying fields so the rest stays usable for analysis.
Pseudonymization on the CompTIA Security+ exam
Pseudonymization is taught under SY0-801 objective 3.3, which covers protecting data, as one of the two levels of de-identification. Wording such as "replace patient names with study IDs and keep the mapping separately", "analysts must not see identities, but the organization must be able to re-identify records later" or "reversible de-identification" points to pseudonymization. Distractors include anonymization, which can't be reversed; hashing without a key; static data masking; and encrypting the entire data set, which blocks the analysis the scenario needs.