Pseudonymization

Pseudonymization specifically targets direct identifiers—fields that uniquely pinpoint an individual without additional context.

• Direct identifiers (replaced): Name, email address, social security number, passport ID, phone number
• Indirect identifiers (retained): Date of birth, ZIP code, gender, occupation

The distinction is critical: retaining indirect identifiers preserves analytical value for trend analysis and cohort studies, but creates linkability risk when quasi-identifiers are combined. Effective pseudonymization requires a thorough data inventory to classify every field correctly before transformation.

Pseudonymization employs two primary technical mechanisms, each with distinct security properties:

• Tokenization: Replaces identifiers with randomly generated tokens stored in a separate, secured lookup table. The original value is irretrievable without access to the token vault. Commonly used for payment card data.
• Cryptographic hashing: Applies a one-way function (e.g., SHA-256) with a secret salt to generate pseudonyms. Deterministic when the same salt is used, enabling consistent pseudonym generation across datasets without storing a mapping table.

Unlike anonymization, pseudonymization is reversible by authorized parties who hold the mapping key or salt.

Pseudonymized data remains personal data under GDPR because re-identification is possible through:

• Linkage attacks: Combining pseudonymized datasets with external publicly available records using quasi-identifiers. The famous Netflix Prize dataset was de-anonymized by correlating movie ratings with IMDb public reviews.
• Inference attacks: Deriving identity from statistical patterns in the data itself
• Insider threats: Authorized personnel with access to both pseudonymized data and the mapping table

Risk mitigation requires k-anonymity enforcement, strict access controls, and contractual prohibitions on re-identification attempts.

In machine learning workflows, pseudonymization enables privacy-preserving model training while maintaining data utility:

• Feature engineering: Pseudonyms preserve row-level uniqueness for sequence modeling and user-behavior analysis without exposing actual identities
• Federated learning compatibility: Pseudonymized local datasets can be aligned across nodes using consistent hashing schemes
• Differential privacy pairing: Pseudonymization combined with DP-SGD provides defense-in-depth—pseudonyms prevent casual observation while differential privacy provides mathematical guarantees against membership inference

Pseudonymization alone does not prevent model inversion attacks; it must be layered with other privacy-preserving techniques.

Pseudonymization occupies a specific legal position within the GDPR framework:

• Article 4(5): Defines pseudonymization as processing personal data so it can no longer be attributed to a specific data subject without additional information kept separately
• Article 6(4)(e): Lists pseudonymization as a safeguard enabling further processing for compatible purposes
• Article 25: Identifies pseudonymization as an appropriate technical measure for data protection by design
• Article 32: References pseudonymization as a security measure for risk-appropriate processing

Critically, pseudonymized data is not exempt from GDPR—unlike truly anonymous data—but benefits from reduced compliance burden.

The boundary between these techniques defines legal obligations:

True anonymization requires irreversible transformation where re-identification is impossible by any means reasonably likely. Pseudonymization retains reversibility for authorized parties, making it the pragmatic choice when data linkage across sessions or systems is required.

A foundational privacy property ensuring each released record is indistinguishable from at least k-1 other records with respect to quasi-identifiers (like age, ZIP code, or job title).

• Generalization: Replacing specific values with broader ranges (e.g., age 34 → '30-40')
• Suppression: Removing or masking outlier values that break anonymity sets
• Works hand-in-hand with pseudonymization to prevent linkage attacks where pseudonymized data is cross-referenced with public datasets to re-identify individuals

A privacy by design principle dictating that only the minimum amount of personal data necessary for a specific purpose should be collected and processed.

• Reduces the attack surface for model inversion and membership inference
• Pseudonymization supports minimization by allowing data utility without retaining direct identifiers
• Key GDPR requirement under Article 5(1)(c): 'adequate, relevant and limited to what is necessary'

An attack that infers sensitive demographic or personal attributes about individuals in the training data by analyzing a model's statistical outputs.

• Exploits correlations between non-sensitive features and protected attributes
• Pseudonymization alone does not prevent this—attackers work with patterns, not identifiers
• Mitigation requires combining pseudonymization with differential privacy or information bottleneck techniques

A mathematical framework providing provable privacy guarantees by injecting calibrated statistical noise into data or model outputs, governed by the privacy budget parameter epsilon (ε).

• Complements pseudonymization by protecting against statistical inference even when identifiers are removed
• Lower epsilon values mean stronger privacy but reduced utility
• Implemented in training via DP-SGD (Differentially Private Stochastic Gradient Descent)

A defense mechanism that truncates or suppresses the full prediction vector returned by an API to prevent attackers from exploiting fine-grained confidence values.

• Only returns top-k predicted classes instead of complete probability distributions
• Reduces the information leakage that fuels model inversion attacks
• Critical when serving models trained on pseudonymized data to prevent reconstruction of statistical properties

A security process that logs and analyzes incoming inference requests to detect and block suspicious query patterns indicative of extraction or inversion attacks.

• Monitors for systematic probing, high-frequency queries, or gradient-based attack signatures
• Works as a runtime defense layer on top of pseudonymization
• Often combined with rate limiting and prediction vector truncation for defense-in-depth