Pseudonymization replaces identifying data with pseudonyms, fake identifiers, or keys that limit—but do not prevent—identification. It is reversible because authorized information can connect the pseudonym to protected data stored separately. Unlike full anonymization, it preserves a controlled path for later use. section 8.3.2 section 8.4
A practical pseudonymization workflow separates analytical needs from identifying information:
- Remove fields that analysis does not require, such as names, phone numbers, addresses, or other direct identifiers. section 8.3.2
- Replace retained identifiers with coded references, pseudonyms, or keys. section 8.3.2 section 8.4
- Store the identifying information and linking table separately, with access limited to specific use cases. section 8.3.2
- Set guardrails against deanonymization, including data minimization and suitable aggregation when reporting results. section 8.3.4 section 8.4
Online retailer
An e-commerce company may retain customer contact, address, and payment information to support recurring purchases while excluding those fields from the analytical warehouse. A separate mapping can connect an analytical customer ID to the protected record when an approved business use requires it. In Python, analysts can also standardize geographic fields, drop original addresses, and create hashed email identifiers; the protected email-to-hash mapping remains separate. section 8.3.2
Table 8.1 Examples of anonymized and pseudonymized data
|
Example
|
Anonymized
|
Pseudonymized
|
|---|---|---|
|
Medical research
|
Patients have names, birthdays, and contact information removed from the data warehouse.
|
Patients have names replaced with pseudonyms and a unique identifier that can be tied to their contact information.
|
|
Human resources management
|
Employees have names, social security numbers, and birthdays masked from view.
|
Employees have all identifying information stored in a separate table with restricted access.
|
|
Customer surveys
|
Respondents have no identifying information collected.
|
Respondents can share their emails for future studies, which are only accessible by survey tool admins.
|
Compare anonymization and pseudonymization across medical research, human resources, and customer surveys. section 8.3.2
