{"id":107,"date":"2011-12-28T02:27:46","date_gmt":"2011-12-28T02:27:46","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=107"},"modified":"2025-04-09T14:22:21","modified_gmt":"2025-04-09T18:22:21","slug":"what-is-pseudonymization","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/","title":{"rendered":"What is Data Pseudonymization?"},"content":{"rendered":"

\"pseudonymization\"<\/a>This article deals with pseudonymization as one method of de-identifying or anonymizing sensitive data. IRI publishes more in-depth information on the topic in its learning center article on pseudonymization here<\/a>.<\/em><\/p>\n

The unauthorized use or misuse of our personally identifiable information (or PII) — such as name,\u00a0 social security number, date of birth, mother’s maiden name, place of birth, etc. — can result in identify theft and other crimes related to impersonation, not to mention embarrassment, inconvenience and expense. For those organizations collecting or processing PII but not protecting it, there are serious legal and financial ramifications which is why more organizations are focused on data risk mitigation<\/a>.<\/p>\n

The “Guide to Protecting the Confidentiality of Personally Identifiable Information” by Erika McCallister goes into great detail about protecting PII, and the processes of pseudonymization and de-identification.<\/p>\n

According to Wikipedia, and a few other online sources, pseudonymization<\/a> is the process of “removing the association between data and the subject of that data, and adding an association between the data and an alternative identifier.” \u00a0It is the process of \u00a0“depersonalizing” the data so that any identifying fields within a record are\u00a0replaced by one or more artificial identifiers.<\/p>\n

In other words, personal data is removed from a database record or file and replaced with a pseudonym (pseudo-name or fake name) to protect the sensitive name. The fields are placed to look realistic.\u00a0 Using a fake name can help protect sensitive PII from unauthorized misuse because it removes the individual’s association to the remaining data in the record or otherwise on hand.<\/p>\n

Thus, the United States Department of Health and Human Services’ Health Information Knowledgebase maintains that “using pseudo-identifiers can assist in compliance with HIPAA<\/a> regulations regarding suppression of patient identification information.” Article 4(3b) of the European General Data Protection Regulation (GDPR<\/a>)\u00a0 considers pseudonymization similarly compliant so long as “the data can no longer be attributed to a specific data subject without the use of additional information, [and] as long as such additional information is kept separately and subject to technical and organizational measures to ensure non-attribution to an identified or identifiable individual.”<\/p>\n

Pseudonymization Methods<\/h2>\n

IRI FieldShield<\/a> and IRI DarkShield<\/a> data masking software products offer two primary ways to pseudonymize\u00a0PII<\/a>:<\/p>\n

1) Unrecoverable<\/em>.\u00a0 This method uses a single-column source or ‘set’ file containing first names, cities, or other values that are listed and available for random selection in place of the original value. Because there is no association between the original and fake values, there is no way to reverse this process, even if you want to reveal the original.<\/p>\n

2) Recoverable<\/em>.\u00a0 This method, which would not be considered compliant with the GDPR, involves a tabular relationship between the source data and its pseuduonym. In practice, a two-column set file using both real and fake data constitutes a look-up table that can be used for both pseudonym display and later restoration of the pseudonym values through a reverse lookup.<\/p>\n

IRI<\/a> recognized the value of this de-identification or pseudonymization method long ago when using set files in its test data generation tool,\u00a0RowGen<\/a>. \u00a0Test data quality is improved, without breaching privacy, when real-looking names replace actual names.<\/p>\n

In practice, pseudonymization jobs can be complicated by the introduction of new values in the source; new substitute values need to exist to cover them, and done in such as way that reidentifiability is still prevented. One such remedy, documented here<\/a>, is to use hashed name values stored in a .set file.<\/p>\n

For Extra Security<\/strong><\/h3>\n

Security can be compromised when someone can still guess the target individual’s real identity … perhaps because there are too many other identifying elements in the record. \u00a0In these cases, it makes sense to apply other protections to the remaining fields. Another consideration\/requirement of the pseudonymization method regards reversibility–the extent to which the real data can be recovered or the ease with which it can be accomplished. \u00a0It may therefore make sense to pseudonymize or mask the data outright, with no means of restoring the original values.<\/p>\n","protected":false},"excerpt":{"rendered":"

This article deals with pseudonymization as one method of de-identifying or anonymizing sensitive data. IRI publishes more in-depth information on the topic in its learning center article on pseudonymization here. The unauthorized use or misuse of our personally identifiable information (or PII) — such as name,\u00a0 social security number, date of birth, mother’s maiden name,<\/p>\n

Read More<\/a><\/div>\n","protected":false},"author":6,"featured_media":11745,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[8,34],"tags":[47,14,13,21,48,16,23,9,22,49],"class_list":["post-107","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection","category-business","tag-data-execution-protection","tag-data-masking","tag-data-protection-2","tag-data-pseudonymization","tag-de-identifying-data","tag-de-identify-data","tag-depersonalizing-data","tag-fieldshield","tag-pseudonymization","tag-rowgen"],"acf":[],"yoast_head":"\nWhat is Data Pseudonymization? - IRI<\/title>\n<meta name=\"description\" content=\"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is Data Pseudonymization?\" \/>\n<meta property=\"og:description\" content=\"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2011-12-28T02:27:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-09T18:22:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"750\" \/>\n\t<meta property=\"og:image:height\" content=\"750\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jeff Simpson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeff Simpson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\"},\"author\":{\"name\":\"Jeff Simpson\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/9c7e21f2a369c971287d5030b7c408e6\"},\"headline\":\"What is Data Pseudonymization?\",\"datePublished\":\"2011-12-28T02:27:46+00:00\",\"dateModified\":\"2025-04-09T18:22:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\"},\"wordCount\":668,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg\",\"keywords\":[\"data execution protection\",\"data masking\",\"data protection\",\"data pseudonymization\",\"de identifying data\",\"de-identify data\",\"depersonalizing data\",\"FieldShield\",\"pseudonymization\",\"RowGen\"],\"articleSection\":[\"Data Masking\/Protection\",\"IRI Business\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\",\"name\":\"What is Data Pseudonymization? - IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg\",\"datePublished\":\"2011-12-28T02:27:46+00:00\",\"dateModified\":\"2025-04-09T18:22:21+00:00\",\"description\":\"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg\",\"width\":750,\"height\":750},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What is Data Pseudonymization?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/9c7e21f2a369c971287d5030b7c408e6\",\"name\":\"Jeff Simpson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c636dae166fc9fecf2b62e88fe135187?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c636dae166fc9fecf2b62e88fe135187?s=96&d=blank&r=g\",\"caption\":\"Jeff Simpson\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/jeffs\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"What is Data Pseudonymization? - IRI","description":"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/","og_locale":"en_US","og_type":"article","og_title":"What is Data Pseudonymization?","og_description":"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/","og_site_name":"IRI","article_published_time":"2011-12-28T02:27:46+00:00","article_modified_time":"2025-04-09T18:22:21+00:00","og_image":[{"width":750,"height":750,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","type":"image\/jpeg"}],"author":"Jeff Simpson","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jeff Simpson","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/"},"author":{"name":"Jeff Simpson","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/9c7e21f2a369c971287d5030b7c408e6"},"headline":"What is Data Pseudonymization?","datePublished":"2011-12-28T02:27:46+00:00","dateModified":"2025-04-09T18:22:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/"},"wordCount":668,"commentCount":1,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","keywords":["data execution protection","data masking","data protection","data pseudonymization","de identifying data","de-identify data","depersonalizing data","FieldShield","pseudonymization","RowGen"],"articleSection":["Data Masking\/Protection","IRI Business"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/","name":"What is Data Pseudonymization? - IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","datePublished":"2011-12-28T02:27:46+00:00","dateModified":"2025-04-09T18:22:21+00:00","description":"Understand the process of pseudonymization to better protect personally identifiable information from unauthorized access.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","width":750,"height":750},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/what-is-pseudonymization\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What is Data Pseudonymization?"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/9c7e21f2a369c971287d5030b7c408e6","name":"Jeff Simpson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c636dae166fc9fecf2b62e88fe135187?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c636dae166fc9fecf2b62e88fe135187?s=96&d=blank&r=g","caption":"Jeff Simpson"},"url":"https:\/\/www.iri.com\/blog\/author\/jeffs\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2011\/12\/data-pseudonymization.jpg","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/107"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=107"}],"version-history":[{"count":175,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/107\/revisions"}],"predecessor-version":[{"id":18344,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/107\/revisions\/18344"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/11745"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}