Pseudonymization

GDPR Art. 4(5) defines pseudonymization and Art. 32 lists it as an example of an appropriate security measure. The LGPD mentions it in Art. 13, §4, in the context of public health research. The key point in both laws is that pseudonymized data remain personal data: whoever holds the key, or can obtain it, can re-identify the individuals.

Typical techniques include replacing identifiers with tokens, keyed hashing and encryption with separately managed keys. The EDPB guidelines on pseudonymisation stress that the benefit depends on who can access the additional information, so the key must be stored apart, with restricted access and logging.

Pseudonymization reduces risk and supports data minimization, privacy by design and the balancing test for legitimate interest, but it does not remove obligations such as lawful basis, transparency or data subject rights. Example: an analytics team trains a churn model on customer records in which names and tax numbers were replaced by random tokens, while the mapping table stays with a separate security team.