What is pseudonymisation?

Pseudonymisation is processing personal data so that it can no longer be linked to a specific person without additional information, which is kept separately and protected. Pseudonymised data is still personal data under the UK GDPR and EU GDPR.

The legal definition

Article 4(5) defines pseudonymisation as processing personal data in such a way that it "can no longer be attributed to a specific data subject without the use of additional information". That additional information must be kept separately and protected by technical and organisational measures.

A simple example: replacing employee names in a spreadsheet with codes, and keeping the table that maps codes back to names in a separate, access-controlled system.

Why it is still personal data

The definition itself assumes the data can be re-linked to a person with the additional information. Under Article 4(1), personal data is any information relating to an identified or identifiable person, including indirectly. Pseudonymised data stays inside that definition, so the GDPR still applies to it.

Pseudonymisation reduces risk. It does not take data out of scope.

Pseudonymisation, anonymisation and masking

These three terms are often used loosely. They mean different things.

The test for anonymisation comes from the same Article 4(1) definition. If information no longer relates to an identifiable person, it is not personal data. That is a high bar, because indirect identification counts.

Masking is a display technique rather than a legal category. A masked email address may still identify someone when combined with other data, so it should not be assumed to be anonymous.

How DOCNUS handles personal data it finds

The DOCNUS privacy assessment finds personal data inside your documents. For each finding it stores:

• the category, for example email address or passport number
• a masked value, such as j***@***.uk
• the page and character position in the document
• which detector found it
• a keyed HMAC-SHA256 fingerprint

The raw value is never stored in the findings, and the raw model response is not kept. The fingerprint is a one-way keyed hash, so it cannot be turned back into the value. The masked value lets you recognise a finding in a list. To see the full value, you open the source document at the cited page.

This does not make the findings anonymous. They still relate to people in your documents, and the documents and their extracted text are stored, because that is how search works. The design limits what is gathered in one place. We explain the reasoning in why we never store the value we found, and the wider controls on our security page.

Further reading

For how personal data is defined in the UK and EU, see what is PII, UK GDPR and the official EU GDPR text.

This page is general information, not legal advice.