Why pseudonymized data isn't anonymous and codes fail law
Pseudonymized data still counts as personal data because codes can be linked back. Learn the legal rules and how our de-identification service meets them.
Written by Jimmy Lin
, 4 min read
Pseudonymized data is still personal data, a placeholder such as "employee 632" can be re-linked to the real person. Regulators therefore require you to destroy the linking key or strip away any clues that would let a reasonable party make the connection.
What pseudonymization does and does not achieve
Pseudonymization swaps direct identifiers, names, Social Security numbers, etc., for a stable placeholder. Inside your organization the data becomes easier to handle, but the placeholder is still a key. If that key surfaces, or if enough indirect details line up, the record can be re-identified.
Regulators treat the placeholder as an identifier unless you eliminate the link or remove every piece of information that could reasonably be combined to reveal a person. In other words, pseudonymization lowers risk; it does not eliminate it.
Legal standards that call for more than a code
| Regulation | Plain-language rule |
|---|---|
| HIPAA (U.S. health data) | A qualified expert must confirm that re-identification risk is very small. Swapping a name for a code is not enough. |
| CCPA (California) | A reasonable person must not be able to link the data to a consumer. A code that matches an employee list fails. |
| GDPR (EU) | The data stays personal until the key is destroyed or the data is rendered un-linkable. |
| PIPEDA (Canada) | Anything that can identify an individual, alone or with other data, remains "identifiable." A stable code is still identifiable if it can be linked. |
| VCDPA (Virginia) | Data is de-identified only when it cannot be reasonably linked to a natural person. Persistent placeholders do not satisfy this. |
All of these rules boil down to the same requirement: destroy the link or make re-linking impractical. A code by itself is just one piece of a puzzle that can be put back together.
Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it
How a thorough de-identification process works
When you ask us for a quote, we start by mapping the systems that hold your data and the legal regime that applies (HIPAA, CCPA, GDPR, etc.). Then we run a repeatable workflow that hits every regulator's checklist:
- Export to an isolated, logged workspace. Raw copies land in a secure area that records every access.
- Replace names with stable placeholders. "John Doe" becomes "employee 632." The mapping key is generated automatically and stored separately.
- Destroy the key. At a mutually agreed point the key file is deleted and we log the receipt. This step turns pseudonymization into true de-identification for most statutes.
- Trim dates, locations and numbers. We blunt timestamps, zip codes, and any granular fields that could act as indirect identifiers.
- Human review. Trained reviewers read free-text fields to catch stray identifiers that automation missed.
- Re-identification test. An independent team that never handled the cleaning attempts to link the cleaned data back to real people. Their findings become a written risk assessment you can share with counsel.
Our dedicated de-identification service is described in detail on the de-identification page. The fee is quoted after we know which systems you use and the volume of records. In a typical deal the AI lab that eventually licenses the data pays for this service, but who pays and who handles raw files is negotiated case by case in the contract.
Why true de-identification matters for AI licensing
AI labs need data that cannot be traced back to individuals because any residual link can invalidate a licensing agreement and expose the buyer to compliance risk. When the data is only pseudonymized, the lab must perform its own risk assessment, which often leads to a lower offer or a request for additional cleaning.
A fully de-identified dataset commands a stronger price because the buyer can use it in a broader set of experiments, including reinforcement-learning environments that simulate real business workflows. The clearer the provenance memo, the more confidence the lab has in the data's legal status, and the higher the potential licensing fee. If you are ready to turn cleaned data into a licensed asset, our sell service can help you negotiate the terms after de-identification is complete.
What you can do today
- Run a quick self-check. List every field you currently replace with a code. If any of those codes could be matched to an internal directory, you are still holding personal data.
- Spot indirect clues. Look for timestamps, project IDs, location codes, or unique transaction numbers that could combine with the placeholder to single out a person.
- Contact us for a quote. Use the button below to start a short questionnaire. We will give you a one-page summary of the de-identification effort for your environment, and no data moves until you give the green light.
If you also want to verify that a prospective buyer's offer meets your privacy expectations, you can review the process on the check-an-offer page.
Questions people ask
Is pseudonymized data ever considered anonymous?
No. All major regulations treat pseudonymized data as still personal because the link to the original individual exists. Only when the linking key is destroyed and indirect identifiers are removed does the data become anonymous.
Does removing a name automatically satisfy CCPA's de-identified standard?
No. CCPA requires that a reasonable person could not link the data to a consumer. If a code can be matched to an employee list, the data remains de-identified personal information under the law.
What extra steps does HIPAA require beyond simple code substitution?
HIPAA allows either the Safe Harbor removal of 18 specific identifiers or an Expert Determination that re-identification risk is very small. A code replacement alone meets neither method; the expert must verify that the key is destroyed and that no other clues remain.
How does your de-identification service reduce re-identification risk?
We replace direct identifiers with stable placeholders, destroy the mapping key, trim dates and locations, run human review of free-text, and perform an independent re-identification test. The outcome is a written risk assessment your counsel can rely on.
Didn't find your question? Ask us directly.
Read next
More articles- De-identification4 min read
HIPAA safe harbor: the 18 identifiers for business data
A concise guide to the 18 HIPAA identifiers, where they appear in daily business records, and how our de-identification service helps you meet safe-harbor.
- De-identification4 min read
De-identified data under CCPA vs anonymous data under GDPR
Learn how California's de-identification rules differ from the EU's anonymity standard and what it means for your data licensing plan.
- For sellers4 min read
Are change orders and RFIs valuable to AI labs?
Change orders and RFIs can be valuable to AI labs when they include the full reasoning and outcome of a work request. Learn why and how to test your fit.