Term · Data, privacy & security
Pseudonymisation
With pseudonymisation you replace names and other identifiable data with a code. That protects the data, but it remains personal data.
In short
Pseudonymisation is processing personal data in such a way that you can no longer link it to a person without additional data, such as a key that you keep separately. It is a security measure. Unlike with anonymisation, the GDPR continues to apply.
What is pseudonymisation?
Pseudonymisation is replacing data that makes someone identifiable with a code or pseudonym. Anyone who sees the data does not directly know who it is about. Only with additional data, which you keep separately, can you link it back to a person.
That is also how it is put in Article 4 of the GDPR. Pseudonymisation is a security measure: if something leaks, the damage can be smaller.
How does pseudonymisation work?
A simple form is a key table. Your file no longer contains a name, but a number, such as ‘customer 1042’. A separate table shows which number belongs to which customer. You keep that table somewhere else, and only a few people can access it.
Another way is hashing: a calculation that turns a piece of data into a fixed code. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) warns that hashed data, too, can often be traced back to a person.
Pseudonymisation or anonymisation?
With anonymisation there is no way back: nobody can link the data to a person any more. Then the GDPR no longer applies. With pseudonymisation, that is possible with the key. So for you, with the key, it remains personal data.
Just leaving out the name is often not enough. A date of birth with a postcode can already make someone identifiable.
Example in an SME
Example
Say you want to have customer complaints summarised by an AI tool. Then you first remove names, email addresses and order numbers from the text and put a code in their place, such as ‘customer A’. You then link the summary back yourself. That way, less identifiable data goes into the tool. Is there still something in it by which you recognise the customer? Then it remains personal data.
When do you use pseudonymisation?
Pseudonymisation suits when you want to work with data but do not need to know who it is about. Think of analyses, testing software or work with AI tools. You can also include it as a measure in a DPIA. It does not prevent a data breach, but it can reduce the consequences.
Want to use AI with customer data? Read how I approach AI in your business.
Frequently asked questions
Is pseudonymised data still personal data?
Yes, for anyone who can link it back with additional data. If you have the key, the GDPR continues to apply to you. So you still have to secure the data properly.
Is blacking out names enough?
Often not. Is there enough left to recognise someone, such as a job title, a place of residence and a date? Then according to the AP it is not pseudonymisation, and not anonymisation either.
This is an explanation in plain language, not legal advice.
Sources: Dutch Data Protection Authority: Pseudonymising data (in Dutch) and the GDPR, Article 4 and Recital 26 (in Dutch). Consulted on 7 October 2026.
Written by Bart van Engelenhoven Founder of Uniekaiconsultancy in Ede, the Netherlands. Bart analyses how SMEs work and builds software, integrations and AI applications himself. Last updated: 7 October 2026
Read more
Term
GDPR (AVG)
The GDPR (AVG) is the European privacy law. Who does it apply to, what are the basic rules and what to watch for with software, integrations and AI?
Read moreTerm
DPIA (data protection impact assessment)
A DPIA maps the privacy risks of a processing activity in advance. When is it mandatory, what goes in it and what does that mean for AI?
Read moreTerm
Data breach (datalek)
A data breach is unintended access to personal data, or its loss. What do you do then, and when do you report it to the Dutch Data Protection Authority?
Read moreNext step
Curious what could work for you?
- The first conversation is free and without obligation
- By phone or at your premises
- You speak directly with me
Bart van Engelenhoven You tell me what takes up your time, I tell you honestly whether I can help.