Pseudonymisation
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Pseudonymisation - Processing data so it can no longer be attributed to a person without separately-kept additional information; a recommended safeguard (but not anonymisation).
In the CIPP/E body of knowledge, Pseudonymisation comes up under Ch 10.2 - Article 32 security of processing; Ch 6.7 - Integrity and confidentiality; IAPP Training · Module 2 - BoK II.A.
Pseudonymisation in context
- The GDPR promotes ==pseudonymisation and encryption==; controllers may also use standards like ==ISO/IEC 27001== or ==NIST==. (Integrity and confidentiality)
- Article 32 expressly flags [[pseudonymisation]] and [[encryption]], and the [[CIA triad]] of confidentiality, integrity, availability plus resilience. (Security principle and the risk-based approach (Article 32))
- [[Pseudonymisation]] is a ==security measure== that reduces risk and is a ==factor in assessing risk== for breaches and transfers. (Module 2 · Anonymous vs pseudonymous data)
Where Pseudonymisation is covered in the CIPP/E study notes
- Integrity and confidentiality
- Security principle and the risk-based approach (Article 32)
- Module 2 · Anonymous vs pseudonymous data
- Module 9 · Appropriate technical and organisational measures (Article 32)
Related terms
- Integrity and confidentiality
- Technical and organisational measures
- Article 32
- Risk-based approach
- State-of-the-art test
- Encryption
- CIA triad
- anonymous data
- pseudonymous data
- masking
Test yourself on Pseudonymisation
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.