Key (cryptographic key and pseudonymisation key)

In data protection and information security, a key is a piece of secret information that controls the transformation of data. Two senses matter in practice. A cryptographic key is the parameter used by an encryption algorithm to convert readable data into ciphertext and back; symmetric algorithms (AES) use the same key for both operations, while asymmetric algorithms (RSA, elliptic curves) use a public-private key pair. A pseudonymisation key, or code key, is the additional information, typically a mapping table or a keyed hash secret, that allows a pseudonym such as a subject number to be linked back to the identity of the data subject.

Both senses are central to the GDPR. Art. 4(5) defines pseudonymisation as processing such that data can no longer be attributed to a specific person without the use of additional information, provided that this additional information is kept separately and protected by technical and organisational measures. The EDPB Guidelines 01/2025 on pseudonymisation stress that the security of the key and the definition of who may access it determine whether the measure is effective. Similarly, Recommendations 01/2020 accept encryption as a supplementary measure for transfers only where the keys are held exclusively by the exporter or a trusted party in the EEA.

In a clinical trial, the investigator holds the code key linking subject numbers to patients, which is why the sponsor's dataset is pseudonymised rather than anonymous. Key management (generation, storage in hardware security modules or key vaults, rotation, access logging and destruction) is therefore a governance question to document in the DPIA, not only a technical one.