What is Pseudonymization?
Also called Tokenization Of Identifiers.
Pseudonymization is the processing of personal data so that it can no longer be attributed to a specific person without additional information kept separately and protected. The GDPR defines it explicitly and treats it as a security and risk reduction measure, but pseudonymized data remains personal data and stays fully within the scope of data protection law.
The mechanism replaces direct identifiers with surrogate values such as random tokens, keyed hashes or reference identifiers, while a separately secured mapping allows authorized re-linking. Because that mapping exists, the data is reversible by design. This is precisely the distinction from anonymization: pseudonymization reduces exposure and blast radius, while anonymization aims to remove the data from legal scope altogether.
Done properly, the key or mapping lives in a different system with different access controls, so a compromise of the analytical store does not by itself reveal identities. Done poorly, the surrogate is an unsalted hash of an email address or a sequential identifier that leaks ordering and volume, both of which can be reversed or correlated with modest effort.
In AI pipelines pseudonymization is often applied before data reaches components with wider exposure. Names, account numbers and contact details are swapped for placeholders before a prompt is logged, before a dataset is shared with an evaluator, or before records are handed to an analytics team. The original values are restored only at the point where they are genuinely needed.
Its legal effect is real but limited. Regulators recognize it as an appropriate technical measure that can lower risk assessments, support a compatible use argument for further processing, and reduce breach notification severity. It does not remove obligations around lawful basis, transparency, retention or individual rights, and describing pseudonymized data as anonymous is a common and consequential error.
Key points
- Identifiers are replaced by surrogates with a separate key
- Reversible by design, so it remains personal data
- Keep the mapping in a separately controlled system
- Unsalted hashes of emails are weak pseudonyms
- Reduces risk but never removes legal obligations
In practice
Before conversation logs are handed to an evaluation team, a preprocessing step replaces each customer email with a token and each company name with a consistent placeholder. The token mapping sits in a restricted service that evaluators cannot reach. Reviewers can still follow a conversation and compare quality across sessions, but a leak of the evaluation dataset would expose behavior patterns rather than identified customers.