What is Pseudonymisation: 5 Techniques and Its Best Practices

What is pseudonymisation: 5 techniques and its best practices

What is pseudonymisation? Pseudonymisation is the umbrella term for procedures that strip identifying information (direct identifiers) from personal data. This practice is used to protect the privacy of data subjects, e.g. employees or customers, and it enables organisations to mitigate the risks associated with processing this information by minimizing the impact of a data breach.

Although the technique isn’t new, the General Data Protection Regulation (GDPR) has elevated its importance by introducing it into EU law. The Regulation even provides a new definition for the term – “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.”

Also read: https://gdpr.report/news/2017/11/07/data-masking-anonymisation-pseudonymisation/

How does pseudonymisation work?

Often data masking or hashing technologies are implemented to conduct the pseudonymisation process. In both cases, an algorithm is used to transform the identifiers into pseudonymised codes. A tool, such as a mapping table, would then be used to match data points between datasets and decipher items of meaningless code back into personal identifiers if and when necessary – for example, transforming ‘C5674’ into the name ‘Tom Jones’.

Effective pseudonymisation is dependent on several key factors. Firstly, the entropy or degree of “randomness” in the hashing algorithm must be to a high standard. Secondly, if the identifier contains information relevant to a business process (for example, postcodes are important to an insurance company assessing risk), then the pseudonymisation operation needs to embed these “attributes” within the hashing algorithm. Finally, GDPR requires that “technical and organisational” measures be taken to separate personal identifiers from the related pseudonymised information.

Why pseudonymisation matters?

Pseudonymisation can significantly reduce the risks associated with data processing without affecting the utility of the data being processed. For example, an organisation can use pseudonymised data as they would unmasked information – to conduct tests, analysis or research – safe in the knowledge that this data will be unreadable if it falls into the wrong hands.

GDPR encourages, rather than mandates, pseudonymisation, including it on its list of recommended risk-based measures for protecting data. Accordingly, applying pseudonymisation techniques can help organisations demonstrate compliance with GDPR.

Also Read: 5 Simple Instructions on How to Access Request Form PDF

Techniques for Pseudonymisation

There are many methods that are used to pseudonymize information, of which there are those that are reversible and those which are not. The following different methods are utilized for varying purposes and each has its own strengths and weaknesses.

1. Scrambling is a technique that entails the mixing and obfuscation of letters. For example, the name Mathew, may once be scrambled, become ‘Teamhw.’
2. Data Blurring, perhaps best exemplified by facial blurring on video footage, renders data obsolete by approximating values and removing the ability to reverse the said process.
3. Masking is a technique of obfuscation that allows data only to be used for specific purposes while minimizing information availability. This method is often employed when you are asked to verify phone or card numbers (e.g., XXX XXXX 5861).
4. Tokenization substitutes sensitive data with a non-sensitive equivalent. A benign and randomly generated ‘token’ can then be used to access the original data. Baring no relation to the original data, tokens can even be single-use, thus increasing their level of security. Tokens also allow organizations to minimize their access, and therefore liability, to sensitive information.
5. Encryption is a process which transposes data into an unintelligible form, a process which can be extremely difficult to reverse, as, without the correct ‘decryption key’ (which is kept separate from the encrypted data), even the most powerful computers on Earth would require thousands of years to ‘crack’ robust encryption methods.

Depending on your purposes and the nature of the data you are handling, one or more of these methods of what is pseudonymisation may be recommended, or even necessary under the GDPR. For instance, if you are handling any special categories of personal data or data that could be considered particularly sensitive, e.g. medical records, your requirements under the law would be different from something such as age group.

Also read: https://cpl.thalesgroup.com/faq/data-protection-security-regulations/what-pseudonymisation