What is pseudonymization?

The technique that replaces identifiers with codes, keeping the re-identification key separate and protected.

Definition

Pseudonymization is the processing by which data loses the possibility of direct or indirect association with an individual, except through the use of additional information kept separately by the controller in a controlled and secure environment.

Unlike the anonymizationPseudonymization is reversible: there is a key, a table, or a token that allows you to return to the person. Therefore, pseudonymized data remains personal data, but with reduced risk.

What does the LGPD say?

A LGPD The Brazilian Constitution defines pseudonymization in Article 13, § 4, when dealing with public health studies, and recommends it as a security measure for these studies. The GDPR (Articles 4, 5, and 25) cites it as an example of a data protection measure from the conception stage. In Brazilian practice, the technique is used as a safeguard in any processing, including in the assessment of legitimate interest and in the impact report.

In practice

Replace CPF (Brazilian individual taxpayer registration number), name, and email with internal identifiers in analytical databases and test environments.
Keep the re-identification key in a separate, restricted-access, and logged location.
Treat pseudonymized data as personal data: it remains in ROPA and subject to the rights of the data subjects.
Combine this with minimization and access control.

How Privacy Tools it deals with the topic

O Data discovery Identifies the fields that need pseudonymization or masking in the systems; the Data Mapping It documents the technique as a safety measure for the treatment activity.

Updated October 3th, 2026.

Want to see this concept applied in practice?

Request a demo and see how... Privacy Tools It organizes mapping, legal bases, rights holder applications, and evidence all in one place.