Definition
To pseudonymise is to remove from a dataset the elements that directly designate a person — name, record number, address, telephone number — and replace them with an identifier carrying no meaning of its own. The correspondence between code and person still exists, but is kept separately, with its own protections.
The GDPR defines pseudonymisation explicitly and presents it as an appropriate security measure. In the same movement it makes clear that pseudonymised data remains personal data, since re-identification stays possible.
Pseudonymisation and anonymisation: the expensive confusion
| Pseudonymisation | Anonymisation | |
|---|---|---|
| Re-identification | Possible, via the correspondence table | Impossible, including by the controller |
| Legal status | Personal data — the full regime applies | Outside the scope of data protection law |
| Reversibility | Intended and controlled | None, by construction |
| Use in research | The norm: longitudinal follow-up requires it | Rare: anonymising often destroys utility |
Why removing names is not enough
A dataset can contain no names and still be re-identifiable by cross-referencing. This is especially true in clinical work, where a handful of attributes often suffices to single out a person within a given department.
- Precise dates. Date of birth, date of procedure and date of discharge together form a near-unique identifier.
- Rare values. An uncommon condition, an extreme age, an unusual occupation.
- Residual free text. A report often mentions a first name, a relative's role, or a contextual detail that automatic processing did not remove.
- Small group sizes. A cross-tabulation isolating two patients designates those two patients.
Hence the usual complementary measures: reduce date granularity, group rare categories, and suppress small counts in any aggregate output.
In practice, within a study
- Separate from the outset. The correspondence table lives elsewhere than the working dataset, with distinct access.
- Pseudonymise before any egress. Anything leaving the infrastructure — an export, a call to an external service, a transfer to a collaborator — goes through the processing.
- Treat free text too. Direct identifiers are common there and escape simple column masking.
- Log access to the correspondence table. It is the most sensitive point of the arrangement.
- Set a duration. The correspondence table is not meant to outlive the study indefinitely.
Applicable frameworks
The GDPR for processing under Union law; in Morocco, law 09-08 and the CNDP for personal data processing, health data included. ICH E6(R3) addresses participant data confidentiality within good clinical practice.