---
title: "Pseudonymization"
description: "Pseudonymization replaces identifiers with stable pseudonyms so data cannot identify a person without separately held additional information. How it differs from anonymization."
url: "https://sonomos.ai/glossary/pseudonymization/"
source: "https://sonomos.ai/glossary/pseudonymization/"
---

# Pseudonymization

Replacing direct identifiers with stable pseudonyms so the data can no longer identify a person without additional information held separately.

## In depth

Pseudonymization, as defined in GDPR Article 4(5), is the processing of personal data such that it can no longer be attributed to a specific person without the use of additional information, kept separately and subject to technical and organisational safeguards. Pseudonymous data is still personal data — it remains in scope of GDPR — but the additional layer of separation reduces risk and is treated as a recommended safeguard. Pseudonymization differs from anonymization (which is irreversible) and from tokenization (which is a specific technical implementation that often qualifies as pseudonymization).

## Examples

- Replacing real names with stable codes ("Patient_4F12") in a research dataset, with the mapping held in a separate, access-controlled vault.
- Routing prompts through Locke's masking so the AI sees pseudonyms while the original mapping never leaves the device.
- An analytics pipeline that hashes user IDs before they reach a downstream model.

## How Locke handles pseudonymization

Locke's masking pseudonymizes flagged data before it reaches an AI model. Because the mapping vault is on the user's device — not on a server — the additional information required to re-identify is held with the strongest possible safeguard.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Anonymization

  Irreversibly transforming personal data so that no person can be identified, even with additional information.
- Tokenization

  Replacing a sensitive value with a non-sensitive token that maps back to the original through a separate, controlled lookup.
- Data Masking

  Replacing sensitive values with realistic-looking substitutes so the data remains usable while the originals never leave the device.

## Reading on this topic

- [GDPR Data Subject Rights and AI: Access, Erasure, and Automated Decisions in 2026](https://sonomos.ai/blog/gdpr-data-subject-rights-ai-2026/)
- [GDPR and AI: A 2026 Compliance Guide for European Teams Using ChatGPT, Claude, and Gemini](https://sonomos.ai/blog/gdpr-ai-compliance-eu-chatgpt-claude-gemini-2026/)