Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person (Art. 4(5) GDPR). In a clinical trial, replacing a participant's name with a subject number while the investigator keeps the enrolment log is the archetypal example; the coding of samples and images works the same way.

Pseudonymisation is a security and risk-reduction measure expressly encouraged by the GDPR (Art. 25, 32 and 89), but it does not take data outside the Regulation. Recital 26 states that pseudonymised data which could be attributed to a person by the use of additional information remains personal data, and the EDPB Guidelines 01/2025 confirm this even where the recipient of the data cannot itself access the key. The concept is therefore fundamentally different from anonymisation, which is irreversible, and from de-identification under HIPAA, which follows a prescriptive US standard.

Effective pseudonymisation depends on design choices that should be documented in the DPIA: who holds the key and under what controls; whether pseudonyms are random codes or keyed hashes; how indirect identifiers such as full dates of birth, rare diagnoses or free text are handled; and how the pseudonymisation domain is defined so that datasets shared with different recipients cannot be linked. Well-designed pseudonymisation lowers risk scores, supports the compatibility of secondary use under Art. 89 and serves as a supplementary measure for international transfers.