Pseudonymized personal data: How should the records be classified for GDPR purposes?

Retained linkability makes the records pseudonymized personal data, not anonymous data, under the EU GDPR.

The question

Preparing for AIGP? Take the free 5-min readiness quiz →

1. Encrypted data because the codes conceal the original values

   Encryption may be a security technique, but it does not answer whether the provider can still link the records to identifiable people.
2. Aggregated data because each traveler has a distinct code

   Distinct codes preserve record-level linkage; they do not combine individuals into statistical groups or remove identifiability.
3. Pseudonymized personal data ✓

   The retained lookup table preserves a means of linking records to travelers, so the data remains personal data in pseudonymized form under the GDPR.
4. Anonymized data after direct identifiers are removed

   Removing names is insufficient because the retained lookup table provides a means of reconnecting records to individuals.

How to remember it

Retained linkability makes the records pseudonymized personal data, not anonymous data, under the EU GDPR.

More Understanding How Laws, Standards and Frameworks Apply to AI questions

• Collect only data necessary for the recommendation purpose: Which distinction is decisive before collection? →
• The authority is controller and provider processor under: Which role allocation follows actual purposes and →
• Use an Article 28 processor agreement: Which control reflects the provider’s role? →
• All 394 Understanding How Laws, Standards and Frameworks Apply to AI questions →