“'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”Parlamentul European și Consiliul Uniunii Europene · Regulamentul general privind protecția datelor (GDPR) · 2016 · Regulamentul (UE) 2016/679, art. 4 pct. 5
Pseudonymised still means personal data — only the key lives in another room.
The regulation's definition, read as architecture, is a three-part schema. The identity vault: name, e-mail, national identifier, address — encrypted, access-restricted, in its own system. The token map: the link between a person and a pseudonym, either a random surrogate or an HMAC with a secret key; a plain hash of the e-mail is not enough, it is reversed with a dictionary. The warehouse: the facts, keyed by token. Analysts see tokens and behaviour, never identities; the join back is possible only for whoever holds the key, and is audited. What you gain: erasing a person becomes deleting the row from the vault — the facts remain, but lead to no one; access to identity is granted separately from access to analysis; "where is this person's data" is answered from provenance (lesson 15). What you do not gain: pseudonymised data is still personal data, because the additional information exists. All obligations remain; the risk drops. Real anonymisation is a different threshold, with traps of its own — lesson 20.
Why it matters A warehouse with the name on every row cannot erase a person without rewriting history. One with tokens erases them from a single row, in another room.