In data de-identification, which approach correctly describes pseudonymization?

In data de-identification, which approach correctly describes pseudonymization?

• A. Removing identifiers entirely from data
• B. Replacing identifiers with a key in the same dataset
• C. Replacing identifiers with pseudonyms while keeping a separate key elsewhere
• D. Removing all data fields that could identify individuals

Answer: (C)

Pseudonymization replaces identifying fields with pseudonyms and keeps the mapping between those pseudonyms and the real identifiers in a separate, securely stored key. This structure reduces the risk of direct identification because the data itself holds only the pseudonyms, not the actual identifiers, and the link to the real identities is available only to authorized parties with access to the separate key. If the key were stored in the same dataset or with the data, re-identification becomes much easier and the protective separation is lost. Removing identifiers entirely or stripping all potentially identifying fields goes beyond pseudonymization and moves toward anonymization, which eliminates the link to the individual and can reduce data utility. Thus, replacing identifiers with pseudonyms while keeping the linking key elsewhere best matches pseudonymization.

Pseudonymization replaces identifying fields with pseudonyms and keeps the mapping between those pseudonyms and the real identifiers in a separate, securely stored key. This structure reduces the risk of direct identification because the data itself holds only the pseudonyms, not the actual identifiers, and the link to the real identities is available only to authorized parties with access to the separate key. If the key were stored in the same dataset or with the data, re-identification becomes much easier and the protective separation is lost. Removing identifiers entirely or stripping all potentially identifying fields goes beyond pseudonymization and moves toward anonymization, which eliminates the link to the individual and can reduce data utility. Thus, replacing identifiers with pseudonyms while keeping the linking key elsewhere best matches pseudonymization.