Pseudonymization

Pseudonymization is processing personal data so it can no longer be attributed to a person without additional information kept separately, GDPR Article 4(5)'s definition. The legal weight sits in that qualifier: if re-attribution is feasible with reasonably available means, for instance by enumerating an unkeyed hash's input space, the data remains personal data with every obligation attached.

The distinction that matters in practice is between pseudonymous and anonymous. Pseudonymized data remains personal data under the GDPR, with every obligation attached, and the controller keeps it only because re-attribution is controlled rather than impossible.

Where a transform genuinely is irreversible for the party holding it, the analysis changes, which is why the reversibility of a hash over an enumerable input space is a legal question and not only a technical one.

The qualifier about additional information kept separately is where most of the analysis happens, and it is a question about capability rather than intent. If the party holding the data can re-attribute it with means reasonably available to them, the data is personal data regardless of what the transform is called or how the separation is described in a policy.

That makes reversibility a legal input rather than only a technical one. An unkeyed digest of a phone number is re-attributable by anyone with commodity hardware, so it does not move the data out of scope; a keyed digest whose key is genuinely held elsewhere changes the analysis for the party without the key, and changes nothing for the party with it.

The practical consequence is that pseudonymization is a risk-reduction measure the regulation encourages, not an exemption from it. Retention limits, subject rights and breach obligations continue to apply, which is why treating a hashing step as the end of the compliance conversation is the error the term exists to prevent. Where a transform genuinely is irreversible, the question becomes whether it produces derived data that can be linked by other means.

The technique that does the work for enumerable identifiers is keyed hashing, and the control is where the key lives.