Pseudonymization

Pseudonymization: A Complete CIPT Guide (Data Collection, Use, Dissemination and Destruction)

Pseudonymization: A Complete Guide for the CIPT Exam

This guide covers pseudonymization within the CIPT domain of Data Collection, Use, Dissemination and Destruction. It explains what pseudonymization is, why it matters, how it works, and how to answer exam questions about it.

1. What Is Pseudonymization?
Pseudonymization is a privacy-enhancing technique. It replaces direct identifiers in a dataset with artificial identifiers called pseudonyms. Direct identifiers include names, Social Security numbers, email addresses and account numbers.

The key feature is that the data can still be linked back to the individual using additional information, such as a key, lookup table or secret salt. That information is kept separately and protected.

Article 4(5) of the GDPR defines pseudonymization as: "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person."

The definition has three essential elements:
• Direct identifiers are replaced or removed.
• Re-identification requires additional information.
• That additional information is kept separately and protected by technical and organizational measures.

2. Pseudonymization vs. Anonymization vs. De-identification
This distinction is among the most heavily tested points on the exam.

• Pseudonymized data: Re-identification is possible with the key or additional information.
  – It is still personal data under the GDPR (Recital 26).
  – Data protection obligations still apply.

• Anonymized data: Re-identification is not reasonably possible by any party, using all means reasonably likely to be used.
  – It is no longer personal data, so the GDPR does not apply.
  – The process is irreversible.

• De-identification: A broader umbrella term, common in U.S. contexts such as HIPAA. It covers a range of techniques that remove or obscure identifiers.
  – Pseudonymization is often described as one form of de-identification.

• Reversibility:
  – Pseudonymization is reversible by design for authorized parties.
  – Anonymization is irreversible.

• Other legal frameworks:
  – The CCPA/CPRA defines pseudonymization similarly. It requires that the additional information be kept separately and protected.
  – The CCPA treats "deidentified" data as a separate category with its own requirements.

3. Why Is Pseudonymization Important?

• Risk reduction: It lowers the risk to data subjects if a dataset is breached, lost or misused. An attacker holding only the pseudonymized data cannot easily identify individuals.

• Data minimization and purpose limitation: Analysts, researchers and developers can work with data without seeing who the individuals are. This supports the principle of least privilege.

• Privacy by Design and by Default: GDPR Article 25 explicitly names pseudonymization as an example of an appropriate technical measure.

• Security of processing: GDPR Article 32 lists pseudonymization and encryption as measures that may ensure a level of security appropriate to the risk.

• Flexibility for further processing:
  – Article 6(4) treats it as a safeguard when assessing whether further processing is compatible with the original purpose.
  – Article 89 treats it as a safeguard for scientific research, historical research and statistical purposes.

• Breach notification considerations: Strong pseudonymization or encryption, with the key not compromised, can lower the risk assessment of a breach. This may affect whether notifying individuals is required.

• Retained utility: Unlike anonymization, the data stays linkable.
  – Longitudinal studies, record matching across datasets and re-contacting individuals remain possible when legitimately needed.
  – Examples include notifying a clinical trial participant of a health finding.

4. How Does Pseudonymization Work? (Common Techniques)

• Tokenization:
  – Identifiers are replaced with random tokens.
  – The token-to-value mapping is stored in a secured token vault.
  – This is common in payment card processing (PCI DSS).

• Counter or sequence numbers:
  – Each identifier is replaced with a sequential number (Subject 001, 002...).
  – It is simple, but the mapping table must be protected.

• Random number generation:
  – Random pseudonyms are assigned.
  – A mapping table stores the links.

• Cryptographic hash functions:
  – A one-way function such as SHA-256 is applied to the identifier.
  – Unsalted hashes are weak. Common values like phone numbers or emails can be recovered by brute force or dictionary attacks.

• Keyed hash (HMAC) or salted hash:
  – A secret key or salt is combined with the identifier before hashing.
  – This makes brute force impractical without the key.
  – The key is the "additional information" that must be kept separately.

• Encryption:
  – Identifiers are encrypted with a key, either deterministically or probabilistically.
  – Anyone holding the decryption key can reverse it.

• Format-preserving encryption:
  – Ciphertext keeps the original format, for example a 16-digit number stays 16 digits.
  – This helps when legacy systems expect a specific format.

Policies for assigning pseudonyms
These follow ENISA terminology:
• Deterministic: The same identifier always maps to the same pseudonym. This allows linkage across datasets.
• Document-randomized: The same identifier gets different pseudonyms in different datasets. This limits linkage.
• Fully randomized: The same identifier gets a different pseudonym every time it appears. This gives the strongest unlinkability.

Process steps in practice
1. Identify direct identifiers, and possibly quasi-identifiers.
2. Choose a technique suited to the use case and risk.
3. Generate pseudonyms and replace identifiers.
4. Store the key or mapping table separately, under strict access control, encryption and logging.
5. Apply organizational measures:
  – role separation, so the people who hold the key are not the analysts;
  – contractual prohibitions on re-identification;
  – training.
6. Periodically reassess re-identification risk, especially when combining datasets.

5. Limitations and Risks

• Quasi-identifiers remain: Data like ZIP code, birth date and gender can still allow re-identification through linkage attacks. Latanya Sweeney's research showed that ZIP code, birth date and sex uniquely identify most Americans.

• Weak techniques: Unsalted hashing of low-entropy data is easily reversed.

• Key compromise: If the key or mapping table leaks, the protection is lost.

• Linkability: Deterministic pseudonyms allow profiling across datasets.

• Legal status: Pseudonymized data is still personal data. Lawful basis, transparency, data subject rights and retention limits all still apply.

6. Where Pseudonymization Fits in the Data Life Cycle

• Collection: Pseudonymize at or near the point of collection to minimize exposure, for example with client-side tokenization.

• Use: Analytics, testing and development environments should use pseudonymized data rather than production identifiers.

• Dissemination: Share pseudonymized datasets with researchers or vendors and keep the key in-house. Pair this with contracts prohibiting re-identification.

• Retention and destruction:
  – Destroying the key can move data closer to anonymization.
  – However, residual quasi-identifiers must still be evaluated before the data is treated as anonymous.
  – Key destruction is sometimes called crypto-shredding when applied to encrypted data.

7. Exam Tips: Answering Questions on Pseudonymization

Tip 1: Remember the legal status. If a question asks whether pseudonymized data falls under the GDPR, the answer is yes: it is still personal data. Only truly anonymized data falls outside scope. This is the most frequently tested point.

Tip 2: Look for the word "reversible" or "additional information."
• If re-identification is possible with a key, it is pseudonymization.
• If it is impossible by any reasonable means, it is anonymization.

Tip 3: "Kept separately" is the critical safeguard. In a scenario where the mapping table sits in the same database as the pseudonymized data, with open access, recognize this as weak or ineffective pseudonymization. The best answer will usually recommend separating the key and restricting access.

Tip 4: Know the GDPR articles that mention pseudonymization.
• Art. 4(5): definition
• Art. 6(4): compatibility of further processing
• Art. 25: Privacy by Design
• Art. 32: security of processing
• Art. 89: research safeguards
• Recitals 26, 28 and 29
Questions may ask which measure the GDPR specifically names. Pseudonymization and encryption are the two named in Art. 32.

Tip 5: Pick the technique that fits the scenario.
• Need to link records across datasets or over time: deterministic pseudonyms or keyed hashing.
• Need to prevent linkage: randomized pseudonyms.
• Need to preserve data format for legacy systems: format-preserving encryption or tokenization.
• Payment card data: tokenization.
• Need to re-contact participants: reversible pseudonymization with a securely held key, not anonymization.

Tip 6: Beware unsalted hashes. If an answer choice says hashing email addresses with plain SHA-256 makes data anonymous, it is wrong. Hashing small or predictable input spaces is reversible by dictionary attack. Prefer salted or keyed hashes, and still treat the result as personal data.

Tip 7: Do not overstate the protection. Answers claiming pseudonymization "eliminates all privacy risk" or "removes the need for consent or a lawful basis" are incorrect. It reduces risk and is a safeguard. It is not an exemption.

Tip 8: Consider quasi-identifiers. If a scenario removes names but leaves detailed birth dates, ZIP codes and rare diagnoses, the data may still be re-identifiable. Additional techniques may be needed alongside pseudonymization:
• generalization
• suppression
• k-anonymity
• differential privacy

Tip 9: Read for the technologist's perspective. The CIPT exam favors practical, technical-plus-organizational answers. The best answer often combines:
• a technical measure, such as keyed hashing or tokenization;
• an organizational measure, such as role separation, access control or contractual bans on re-identification.

Tip 10: Distinguish encryption from pseudonymization.
• Encryption protects confidentiality of whole data, in transit or at rest.
• Pseudonymization specifically replaces identifiers so data stays usable for processing.
• Encryption of identifiers can be a pseudonymization technique, but the two concepts are not identical.

Tip 11: Eliminate wrong answers systematically. Remove options that:
• confuse pseudonymization with anonymization;
• store the key with the data;
• claim GDPR no longer applies;
• rely on weak, reversible methods without a secret.

8. Quick Review Summary
• Pseudonymization replaces identifiers with pseudonyms. Re-identification needs separately held additional information.
• It is reversible, and the result is still personal data.
• It reduces risk, supports data minimization, Privacy by Design, security and research, and enables safer sharing.
• Techniques include tokenization, counters, random numbers, salted or keyed hashing, encryption and format-preserving encryption.
• Its effectiveness depends on protecting and separating the key and on handling quasi-identifiers.
• For the exam, remember: reversible + still personal data + key kept separately = pseudonymization.