Derived data

Derived data is anything computed from personal data: hashes, fingerprints, embeddings, scores. It is the category where privacy claims most often fail, because a vendor can truthfully say it stores no personal data while storing derivations that are reversible or re-identifiable. Whether derived data is still personal data depends on the derivation's reversibility, not on its name.

The test is whether the derivation can be inverted or linked by a party that holds it, with the resources that party actually has. A digest of a phone number is trivially invertible without a key; an embedding may be invertible enough to reconstruct approximate inputs; a count is not.

Saying that a system stores no personal data while storing reversible derivations of it is the failure mode this term exists to name, and it is usually sincere rather than deceptive.

Naming the derivations is what makes the question answerable, because the answers differ sharply across things that all get called derived. A digest of an enumerable identifier can be inverted without a key; a model embedding may permit approximate reconstruction of its input; an aggregate count over a large population permits neither. One word covers all three, and only an inventory of which derivations a system actually stores tells anyone which case they are in.

Linkage is the second half and it is easier to overlook than inversion. A value that cannot be turned back into an identifier can still act as a stable join key across datasets and sessions, which is enough to build a profile and enough to re-identify when joined against something external. A derivation that is irreversible and stable is still a persistent identifier.

This is the category where a privacy claim can be sincere and wrong at the same time, which is why contracts increasingly ask about derivations by name rather than accepting a statement that no personal data is stored. The honest form of the claim states what is derived, how, and what the party holding it can do with it, which is the same discipline pseudonymization requires under the regulation.

For identifiers, the derivation that survives the question is keyed hashing under a key the holder of the digests cannot read.