Pseudonymous Data
What is Pseudonymous Data?
Personal data that cannot be attributed to a specific individual without the use of additional information kept separately and securely.
Terms that appear alongside pseudonymous data
Each of these is named in at least one of the same controls as pseudonymous data. The number is how many controls name both.
- de identification 6 shared controls
- pseudonymisation 3 shared controls
- attestation 3 shared controls
- state privacy laws 3 shared controls
- gdpr 3 shared controls
- encryption 2 shared controls
- integrity 2 shared controls
- glba 2 shared controls
Frameworks that govern pseudonymous data
What the standards actually require on pseudonymous data
Requirements naming pseudonymous data across 6 standards, quoted from the control text.
A controller that discloses pseudonymous or de-identified data must exercise reasonable oversight to monitor compliance with the contractual commitments attached to it and take appropriate steps to address breaches of those commitments.
montana-consumer-data-privacy-act::30-14-2815(5) · 30-14-2815(5): oversight of disclosed de-identified and pseudonymous data →A controller in possession of de-identified data must take measures to prevent re-identification, publicly commit to maintaining de-identification, and contractually obligate recipients to comply; rights do not apply to de-identified data.
COPA-1307-DEIDENT · De-identified and Pseudonymous Data →Controllers in possession of de-identified data must take reasonable measures to prevent re-identification, publicly commit to maintaining de-identification, and contractually bind recipients; rights do not apply to de-identified/pseudonymous data.
CTDPA-42-521-DEIDENT · De-identified and Pseudonymous Data →Whether a natural person is identifiable is judged on all the means that can reasonably be used by the holder or any other party to identify them: identifiers (4.4.1), other distinguishing characteristics (4.4.2), information that is, or could be, tied to a pr...
iso-iec-29100-2024::4.4 · 4.4 Recognizing PII (identifiers, distinguishing characteristics, linkable information, pseudonymous data, metadata, unsolicited PII, sensitive PII) →Access, correction, deletion and portability rights and the controller duties in IC 24-15-4-1(1) to (5) do not apply to pseudonymous data only where the controller can show that identifying information is kept separately under effective technical and organisat...
indiana-consumer-data-protection-act::24-15-7-2 · IC 24-15-7-2 Pseudonymous data carve-out requires separation under effective controls →The Act does not require reidentifying deidentified data or associating requests with data a controller cannot reasonably link, and the access, correction, deletion, portability and third-party-list rights do not apply to pseudonymous data whose identifying in...
minnesota-consumer-data-privacy-act::325M.15 · 325M.15(c) to (e): oversight of deidentified and pseudonymous data and no reidentification →Questions people ask about pseudonymous data
What is Pseudonymous Data?
Why is Pseudonymous Data important for compliance?
Which compliance frameworks address Pseudonymous Data?
Where can I learn more about Pseudonymous Data?
See how Pseudonymous Data applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.