The Myth: Swap The Names For IDs And The Law Goes Away
Here is a belief I hear from good engineers all the time. It goes like this.
"We took the customer table. We replaced every name with a random ID like u_7f3a91c2. We dropped the email column. Nobody on the analytics team can see who anyone is. So the data is anonymous now, and privacy law no longer applies to it."
(A table here is like a spreadsheet: each row is one customer, each column is one kind of fact, such as name or city. The analytics team are the people who study those numbers to answer business questions.)
It sounds reasonable. Nobody can read a name. But it is wrong.
Here is the short answer, before any law. Data pseudonymization means replacing names, emails and phone numbers with stand-in values, while a way back to the real person still exists, kept in a separate, locked place. Because that way back exists, the result is still personal data: information about a person who can be identified, such as a name, a phone number or a record of what someone bought. Anonymization is different. It removes the way back for everyone, and only then does the data leave the privacy rules.
The European Union's General Data Protection Regulation, which most people call GDPR, has a name for exactly what that team did. Article 4(5) defines it. A few words in it need explaining first: a data subject is the person the data is about, and a natural person is a human being, as opposed to a company. "Attributed to" means "linked back to".
'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
In plain words: you can no longer tell who a row belongs to unless you also have some extra information, and that extra information is kept somewhere else, under lock.
Recital 26 of the same law settles whether the rules still apply. A recital is an explanation printed at the start of an EU law, telling you how to read the articles that follow:
Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
So the table with random IDs is still personal data. The same recital says the rules stop applying only to anonymous information, "information which does not relate to an identified or identifiable natural person", or data "rendered anonymous in such a manner that the data subject is not or no longer identifiable."
Both panels start from the same table with the names swapped for IDs. Only the conclusion changes, and the law draws the second one, because a way back to the person still exists somewhere.
I did not want you to take my summary of the definition on trust, so here is the passage itself, photographed on EUR-Lex, the official site that publishes EU law.
The definition has two halves, and both have to be true. The data alone must not name anyone, and the extra information that could name them must be kept apart and protected.
In this lesson I will show you why the law draws that line, how each technique really works, where the way back to a person hides, and when this tool is the right one. You will also run a small lab that breaks a badly pseudonymized table in under two seconds. Near the end I go through what the cloud tools actually do: Google Cloud, AWS Glue, Azure and Oracle NetSuite. One short answer up front, because people search for it: NetSuite's documentation describes no pseudonymization feature. Its Remove Personal Information tool erases data instead. When I quote the law I use its spelling, "pseudonymisation". Everywhere else I use "pseudonymization". Some people type it as "psuedonymization". It is the same idea.