Pseudonymization

The irreversible process of altering personal data so that the data subject can no longer be identified, directly or indirectly, by the controller or any other party. Unlike pseudonymization, anonymized data ceases to be personal data under GDPR and falls outside the regulation's scope.

• Key distinction: Pseudonymized data remains personal data because re-identification is possible with additional information
• Techniques: Aggregation, randomization, generalization, and suppression
• Legal threshold: Requires that re-identification is impossible considering "all means reasonably likely to be used"

A data security technique that substitutes a sensitive data element with a non-sensitive equivalent, called a token, that has no extrinsic or exploitable meaning or value. The mapping between the original data and the token is stored in a secure token vault.

• Format preservation: Tokens often maintain the length and character set of the original data to avoid breaking downstream applications
• Use cases: Payment card industry (PCI) compliance, protecting primary account numbers (PANs)
• Distinction from pseudonymization: Tokenization is typically a security control, not a privacy-enhancing technique, and the token vault is a high-value attack target

A privacy property ensuring that each released record is indistinguishable from at least k-1 other records with respect to quasi-identifier attributes. This prevents an attacker from singling out an individual by linking the dataset to external information.

• Quasi-identifiers: Attributes like ZIP code, birth date, and gender that can be combined to re-identify individuals
• Limitations: K-anonymity does not protect against homogeneity attacks (all k records share the same sensitive value) or background knowledge attacks
• Enhancements: L-diversity and t-closeness extend k-anonymity to address these vulnerabilities

A mathematical framework that provides a formal privacy guarantee by injecting calibrated noise into query results or model outputs. The guarantee states that the presence or absence of any single individual's record in the dataset does not significantly change the probability of any output.

• Epsilon (ε): The privacy loss parameter; lower values provide stronger guarantees (typical range: 0.1 to 10)
• Composability: Privacy loss accumulates across multiple queries, tracked via the privacy budget
• Adoption: Used by the US Census Bureau (2020 Census) and Apple's data collection systems

The process by which an adversary links de-identified or pseudonymized records back to specific individuals by combining the released data with auxiliary information from external sources.

• Famous example: Researchers re-identified the Governor of Massachusetts in supposedly anonymized hospital discharge data by linking ZIP code, birth date, and gender to voter registration records
• Attack vectors: Linkage attacks, singling out, inference attacks, and membership inference
• Mitigation: Formal privacy frameworks like differential privacy provide provable resistance to re-identification regardless of auxiliary data available to the attacker

The process of obscuring specific sensitive data elements by replacing them with structurally similar but inauthentic values. Unlike pseudonymization, masking is typically irreversible and used to create safe copies of production data for non-production environments.

• Static masking: A copy of the database is permanently masked before use in testing or development
• Dynamic masking: Data is masked in real-time at query time based on user permissions, without altering the underlying stored data
• Techniques: Character shuffling, substitution, nullification, and format-preserving encryption