# Pseudonymization

URL: https://sellmydatatoai.net/glossary/pseudonymization

Pseudonymization is processing personal data so it can no longer be linked to a specific person without additional information that is kept separately and secured.

Pseudonymization is the processing of personal information so that it is no longer attributable to a specific person without additional information, provided that information is kept separately and protected by technical and organizational measures. That is the [CCPA](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV) definition at California Civil Code section 1798.140(aa). [NIST](https://csrc.nist.gov/glossary/term/pseudonymization) describes it as a de-identification technique that replaces an identifier with a pseudonym.

Replacing names with ID codes and holding the key elsewhere is a common example.

## Is pseudonymized data deidentified under US law?

Pseudonymized data is not deidentified under the CCPA unless it also meets the three conditions in section 1798.140(m): reasonable measures, a public commitment not to re-identify and contractual limits on recipients. HIPAA allows a re-identification code only if it is not derived from information about the person and the key is not disclosed, under [45 CFR 164.514(c)](https://www.law.cornell.edu/cfr/text/45/164.514).

In an AI data deal this means a seller who keeps the key still holds information that can be linked to people, while the buyer's position depends on what else it holds.

## How does UK GDPR treat pseudonymization?

UK GDPR Article 4(5) uses almost the same wording, and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) says pseudonymized data stays personal data in the hands of anyone who holds the additional information.

See [anonymization](https://sellmydatatoai.net/glossary/anonymization), [re-identification risk](https://sellmydatatoai.net/glossary/re-identification-risk) and [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data).