Glossary · Privacy & regulation
Pseudonymization
Pseudonymization is processing personal data so it can no longer be attributed to a specific person without additional information, which is kept separately and secured — a GDPR-recognized risk-reduction measure, but the data remains personal data in scope.
GDPR Article 4(5) defines pseudonymization specifically: replacing identifying fields with an artificial identifier (a token, a hash, a reference number) and keeping the mapping between the two separately, under technical and organizational controls that prevent re-attribution. A customer database with names replaced by tokens, where a separate, access-restricted table holds the token-to-name mapping, is a canonical example.
The key legal point is that pseudonymized data is still personal data under GDPR — because the possibility of re-identification exists, even if it’s access-controlled, the regulation continues to apply in full. What pseudonymization buys is risk reduction (a leak of the pseudonymized dataset alone doesn’t directly expose identities) and it’s explicitly named in Article 25 and Article 32 as an appropriate technical measure for privacy by design and for security of processing — but it is not a substitute for anonymization when an organization actually wants data to fall outside GDPR’s scope.
A blind index is a form of pseudonymization applied to a specific problem — search over encrypted data — where the "additional information" needed for re-identification is the encryption key or the original plaintext value, held separately from the searchable token itself.