Pseudonymisation
What is Pseudonymisation?
The processing of personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information. Unlike anonymisation, pseudonymised data is still considered personal data under GDPR.
Terms that appear alongside pseudonymisation
Each of these is named in at least one of the same controls as pseudonymisation. The number is how many controls name both.
- encryption 37 shared controls
- gdpr 32 shared controls
- confidentiality 25 shared controls
- data protection 23 shared controls
- integrity 19 shared controls
- anonymisation 17 shared controls
- availability 17 shared controls
- breach notification 17 shared controls
Frameworks that govern pseudonymisation
What the standards actually require on pseudonymisation
Requirements naming pseudonymisation across 6 standards, quoted from the control text.
Standard 7 per Section 35 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed in a manner that ensures appropriate security including protection against unauthorised or unlawful processing + accidental loss + destruction or...
JM-DPA2020-Standard7-Security-Sec35-Appropriate-Technical-Organisational-Confidentiality-Integrity-Availability-Resilience · Jamaica DPA 2020 Standard 7 - Security + Section 35 + Appropriate Technical and Organisational Measures + Confidentiality + Integrity + Availability + Resilience + Encryption + Pseudonymisation + Risk-Based Security →Particular caution must be exercised in any project processing genetic or biometric data, because such data are unique, can reveal health predispositions, inherited diseases and kinship, affect relatives as well as participants, cannot be changed and remain fo...
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::8.4 · 8.4 Genetic and biometric data: particular caution, restrictive purposes, pseudonymisation, ethical approval, federated storage with secure access, role-based controls, and community information for isolated populations →Articles 53 and 67: an applicant may seek access only for the Article 53(1) purposes (public or occupational health, policymaking and regulation, official statistics, which three are reserved to public sector bodies; health education;
regulation-on-the-european-health-data-space-ehds::67 · Submit complete access applications with purpose, data, safeguards and pseudonymisation justification →Pseudonymisation (GDPR Art.4(5)) processes personal data in a way that the data can no longer be attributed to a specific data subject without additional information kept separately and subject to technical and organisational measures.
ENISA-DPE-3.2 · Pseudonymisation →Both when deciding the means of processing and during processing, the controller must apply appropriate measures to comply with the Decree-Law, including the Article 5 controls; pseudonymisation is named as one such measure.
federal-decree-law-no-45-of-2021-on-the-protection-of-personal-data-uae-pdpl::7(2) · Article 7(2): protection by design, including pseudonymisation →Articles 39 + 46 of UU PDP establish security + breach notification obligations. Article 39: Personal Data Controller shall protect personal data processed through implementation of appropriate technical + organisational + and physical security measures + comm...
IDPdp-Security-BreachNotification-72Hour-Art39-Art46-Encryption-Pseudonymisation-Records-IR · Indonesia PDP Article 39 + Article 46 + Reasonable Security + Encryption + Pseudonymisation + Personal Data Breach Notification 3x24 Hours (72 Hours) to DPA + Data Subjects + IR Plan + Records →Questions people ask about pseudonymisation
What is Pseudonymisation?
Why is Pseudonymisation important for compliance?
Which compliance frameworks address Pseudonymisation?
Where can I learn more about Pseudonymisation?
See how Pseudonymisation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.