What is pseudonymised data?

What is pseudonymised data?

Pseudonymised data is personal data that has been processed so that it can no longer be directly linked to a specific person without extra information. That extra information is kept separately and protected. In the UK, this is often used to reduce privacy risks while still allowing data to be analysed or shared.

It is important to note that pseudonymised data is not the same as anonymous data. The person may still be identifiable if someone has access to the additional information. Because of that, it is still treated as personal data under UK data protection law.

How does pseudonymisation work?

Pseudonymisation usually involves replacing identifying details such as a name, email address, or NHS number with a reference code, token, or other identifier. The link between the code and the real person is stored separately. This helps keep the data useful without revealing the person’s identity straight away.

For example, a research dataset might replace “Sarah Jones” with “Participant 1042.” The mapping file that shows who Participant 1042 really is would be kept securely and only accessed by authorised staff. This limits the chance of someone being identified from the dataset alone.

Why is pseudonymised data used?

Organisations use pseudonymised data to protect privacy while still carrying out tasks such as research, service improvement, fraud detection, and data analysis. It allows businesses and public bodies to work with information in a safer way. It can also reduce the impact if data is accidentally shared or accessed unlawfully.

In the UK, pseudonymisation is encouraged as part of good data protection practice. The Information Commissioner’s Office recognises it as a useful safeguard. It can support compliance with UK GDPR, but it does not remove all legal obligations.

How is it different from anonymised data?

Anonymised data has been changed so that no individual can be identified, even with other information reasonably available. If data is truly anonymised, it falls outside UK data protection law. Pseudonymised data, however, can still be traced back to a person if the extra information is available.

This difference matters because people sometimes assume that pseudonymisation means full anonymity. It does not. Organisations must still handle pseudonymised data carefully, use appropriate security measures, and have a lawful basis for processing it.

What should UK organisations consider?

UK organisations should store the key or mapping information separately and protect it with strong access controls. Only people who genuinely need to re-identify the data should be able to do so. Encryption, role-based access, and strict policies can all help.

It is also sensible to be clear with individuals about how their data is being used. Pseudonymisation can lower risk, but it does not replace transparency, accountability, or good governance. Used properly, it is a practical way to balance privacy with useful data use.