Pseudonymization
Pseudonymization is processing personal data so that it can no longer be attributed to a specific person without additional information kept separately, for example by replacing names with codes or hashing an IP address with a secret salt; the data remains personal data.Article 4(5) of the GDPR defines pseudonymization and Recital 26 makes the key point: pseudonymized data that could be attributed to a person by using additional information is still personal data. The law rewards the technique rather than exempting it. Pseudonymization counts as a security measure (Article 32) and as data protection by design (Article 25), it can support compatibility of further processing (Article 6(4)), and it reduces the risk assessed in a DPIA. The EDPB adopted guidelines on pseudonymization in January 2025 that stress separating the additional information and controlling who can reverse the process.
Common techniques are replacing identifiers with random tokens held in a lookup table, keyed hashing (HMAC) of identifiers, and encryption where the key is held separately. A plain hash of an email or IP address is weak pseudonymization, because the input space is small enough to test candidates; a salted or keyed hash with a secret, rotated salt is stronger.
Consent logs are a typical use. A record needs to be linkable to the browser that made the choice, but not to a named person, so tools store a random visitor identifier and a hashed IP rather than the address itself. Cookiequiet's consent log keeps a random per-site visitor id and a daily-salted hash of the IP address alongside the choice, which lets you prove a consent without keeping identifiable addresses. The stronger step, where the link is destroyed for good, is anonymization; see also personal data.