Pseudonymisation

Pseudonymisation is the processing of personal data so that it can no longer be attributed to a specific data subject without additional information, provided that additional information is kept separately and protected by technical and organisational measures. It is a defined legal term under the EU General Data Protection Regulation (GDPR), not a generic synonym for “de-identified” or “coded” data, and it is one of the specific safeguards GDPR names for research processing. Pseudonymised data remains personal data under GDPR because re-identification stays technically possible — this is the point most often confused with anonymisation, which removes personal-data status entirely.

This term sits within CASRAI’s broader research data management vocabulary, alongside related concepts such as sensitive-data handling in a DMP and data subject rights under GDPR.

Legal definition: GDPR Article 4(5)

GDPR Article 4(5) defines pseudonymisation as:

“the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”

Three conditions have to hold simultaneously for processing to count as pseudonymisation in the GDPR sense:

• Separation — the key or mapping table that could re-link the data to an individual (e.g. a participant-ID crosswalk) is stored apart from the pseudonymised dataset itself, not alongside it.
• Technical and organisational measures — access to that separately-held key is restricted (encryption, access controls, contractual limits) so re-identification is not trivially achievable by anyone holding the pseudonymised data alone.
• Reversibility in principle — the process is designed so that, with the separately-held key, a specific data subject can in principle be re-identified. If that is genuinely no longer possible for anyone, the data has moved from pseudonymised to anonymised (see below).

Pseudonymisation vs. anonymisation

This is the distinction that generates the most confusion, and it has direct legal consequences: pseudonymised data is still personal data and still falls fully within GDPR’s scope; anonymised data is not personal data and falls outside GDPR entirely.

GDPR Recital 26 makes this explicit. On pseudonymised data:

“Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.”

And on anonymised (as distinct from pseudonymised) data, the same Recital states that the data protection principles do not apply to:

“anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”

Recital 26 also sets the test for whether data is truly anonymous (and so outside GDPR) or merely pseudonymised (and so still inside it): whether re-identification is possible using “all the means reasonably likely to be used,” accounting for cost, time, available technology, and technological development over the life of the processing. In practice:

• Pseudonymised data — a re-identification key exists somewhere, even if held separately and access-restricted. GDPR still applies in full: lawful basis, data subject rights (subject to the research derogations discussed below), breach-notification obligations, and international-transfer rules all remain in force.
• Anonymised data — no key exists, and re-identification is not reasonably possible for anyone, including the original controller. GDPR does not apply to this data at all, because it is no longer “personal data” as Article 4(1) defines the term.

A common practical error is treating “coded” research data — direct identifiers replaced by study IDs, with the ID-to-participant key retained by the research team — as anonymised because the dataset itself contains no names. Under GDPR that data is pseudonymised, not anonymised, precisely because the key still exists and re-identification remains technically possible.

Why it matters for research data sharing: GDPR Article 89

GDPR Article 89(1) sets out the safeguards that apply when personal data is processed for archiving in the public interest, or for scientific or historical research or statistical purposes, and names pseudonymisation directly as an accepted measure:

“Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.”

For research data management this has three practical consequences, discussed further in CASRAI’s guide to GDPR and data protection compliance in research:

• It is a named, recognised safeguard, not just good practice. Applying pseudonymisation is one of the concrete measures a controller can point to when demonstrating the “appropriate safeguards” Article 89(1) requires for research processing, alongside data minimisation more broadly.
• It supports the research-specific derogations. Where appropriate safeguards under Article 89(1) are in place, GDPR allows Member State law to derogate from certain data subject rights (Articles 15, 16, 18 and 21, and additionally 19 and 20 for archiving) where exercising those rights would seriously impair or render impossible achievement of the research purposes.
• Article 89(1)’s own preference ordering matters. The article does not treat pseudonymisation as the end state to aim for — it explicitly says that where a research purpose can instead be fulfilled through processing that does not permit identification at all (i.e. genuine anonymisation), that stronger approach should be used. Pseudonymisation is the safeguard for the (very common) case where full anonymisation would defeat the research purpose, for example because participants need to be re-contactable, longitudinal records need to be linked over time, or results need to be traceable back to source records for data-quality or regulatory audit.

This is also why pseudonymisation is central to secondary use and controlled data sharing in practice: because the re-identification key can be held separately (often by the original data controller or a trusted third party) under its own access controls, a pseudonymised dataset can often be shared more broadly — with other named researchers, a repository, or a consortium partner under a data sharing agreement — than the fully identifiable source data could be, while the sharing party still satisfies GDPR obligations for the underlying personal data. This is the same underlying logic behind trusted-research-environment and Five Safes framework access models, where “safe data” (which frequently means pseudonymised, not necessarily fully anonymised, data) is one axis of the overall control framework rather than a full substitute for it.

Common misconceptions

• “Pseudonymised data is anonymous data.” It is not, under GDPR. It is personal data subject to the full Regulation, with narrower derogations available under Article 89 for research purposes specifically.
• “Encryption alone is pseudonymisation.” Encrypting a dataset without separating and protecting the decryption key does not meet Article 4(5)’s separation condition on its own; the key management arrangement is what makes the processing pseudonymisation rather than simple encryption.
• “Once pseudonymised, data can never become anonymised.” The same dataset can move between categories depending on what happens to the key: if the key is later destroyed and re-identification genuinely becomes impossible for everyone, the data has become anonymised (and GDPR ceases to apply to it) even though it started out pseudonymised.

References

• Regulation (EU) 2016/679 (GDPR), Article 4(5) — definition of pseudonymisation.
• Regulation (EU) 2016/679 (GDPR), Article 89(1) — safeguards for archiving, scientific/historical research and statistical purposes.
• Regulation (EU) 2016/679 (GDPR), Recital 26 — anonymous information and the identifiability test.