Pseudonymisation under UK GDPR: what it is and how to do it

Most UK offices already pseudonymise something without calling it that: a payroll export with staff codes instead of names, or a prompt where the client has become a label. The UK GDPR has a precise word for that step, and it comes with a condition people tend to skip.

The condition is that the law keeps applying. Whether an AI tool is acceptable is a separate check on the tool itself. This page deals with the data: what pseudonymisation is, who it protects, the techniques the ICO names and the offence that guards the result.

What is pseudonymisation under UK GDPR? One input, two outputs

Article 4(5) defines it as processing so that the data “can no longer be attributed to a specific data subject” without additional information. That information has to be kept separately, under technical and organisational measures. Leave either condition out and, legally, you haven’t pseudonymised anything.

The ICO describes two outputs from one input: the pseudonymised dataset and the additional information. The second worries me more. It lists every person in the file, in clear, so a lookup table on a hidden sheet of the same workbook defeats the point.

The second output can also sit with a supplier. A data privacy vault such as Skyflow holds the originals in a service its vendor runs, so the question of who has the key gets a third name in it.

Is pseudonymised data personal data? Ask who holds the key

The ICO answers the question in a heading of its own: pseudonymised data is personal data “in the hands of someone who holds the additional information”. The next sentence is the one that gets quoted less. Shared without that information, it “may be anonymous information” in the recipient’s hands.

So the answer depends on the desk you sit at. From the organisation doing the swapping, the answer is always yes, and a DPIA that says otherwise is wrong. That relative view is also the case for sending labelled requests to a provider instead of running a private LLM yourself.

A processor sits in between. An AI provider on a business contract handles the text for you, so for you it remains personal data and the Article 28 contract still matters. What ChatGPT keeps from business accounts is a separate question from what the text contains.

Pseudonymisation vs anonymisation: when UK GDPR stops applying

The ICO puts it bluntly: pseudonymisation reduces risk and improves security, but it is “not a way of transforming personal data” so the law stops applying. Anonymisation is the only exit, and it means identification is no longer reasonably likely by anyone.

“Anyone” is wider than it sounds. The ICO’s page on indirect identification asks you to consider a determined person: investigative journalists, estranged partners, stalkers, industrial spies. Keep that list in mind whenever a file concerns one family or one small team. Age, occupation and place of residence together can single someone out.

The same page uses an HR example: application forms split into two folders, one holding random numbers and the other holding names against those numbers. Put together, the applicant is identifiable. Which personal details belong on the redaction list follows from that.

Public bodies face the same test from another angle when a freedom of information answer could single someone out, which is why councils treat small numbers with suspicion.

Does pseudonymised data include names and addresses?

No. The names and addresses are exactly what moves into the additional information. What stays in the dataset is codes or labels, plus everything that was never a direct identifier in the first place: a job, a town, a date, an amount.

That leftover detail is where pseudonymisation quietly fails. A label instead of a National Insurance number does nothing if the line beside it says the client is the only mobile dog groomer in a small town. If the analysis needs place, keep the postcode district and drop the full code.

Word files add a second layer: an old version of the name may survive in tracked changes and comments, long after the visible text was labelled.

How to pseudonymise data: hashing, encryption or tokenisation

The ICO’s guidance names three families of technique and attaches a caution to each. Before choosing, it asks you to set your goals, list the risks from insiders and outsiders, and decide who does the work: you, a processor or a joint controller.

It also warns that “an inadequate level of pseudonymisation” doesn’t meet the legal definition. An unsalted hash of an NI number is the example that irritates me most. NI numbers follow one fixed pattern, so an attacker can hash every possible one and compare: the brute force attack the ICO warns about.

Labels in an AI prompt are a form of tokenisation, and developer tools have kept the mapping in different places: LLM Guard kept the real values in a vault apart from the text sent to the model.

Storing the additional information, and what a breach changes

Most of the ICO’s practical advice concerns the second output, not the swap. Keep the additional information in a distinct location, restrict who can reach it, encrypt it, log access, manage the keys, think about backups and destroy it once nobody needs it.

A lookup table in the same shared drive as the data falls short of the definition, in my view. Write the arrangement down in your DPIA and records of processing, and give it a line in your AI acceptable use policy if prompts are involved.

Breaches are where the effort pays back. Under Article 34, measures making the data unintelligible to outsiders can spare you telling the people affected, though the ICO says you still inform the regulator. Settle whether a pasted client file counts as a breach before it happens.

Re-identification under section 171 of the DPA 2018

Section 171 makes it an offence to “knowingly or recklessly” re-identify de-identified personal data without the consent of the controller who de-identified it. Section 171(5) adds a second offence: processing the re-identified data. The ICO’s page describes these as the two offences guarding against unauthorised removal of pseudonymisation.

The Act’s word is “de-identified”: data that can’t be attributed to a person “without more”. The ICO notes it differs from pseudonymisation, as nothing requires the key to be kept apart. For a solicitor’s practice sending coded bundles out, suppliers should hear that undoing your labels is criminal, not only contractual.

The defences are set out below. Consent is the hinge: you are the controller, so you decide who may put the names back, and the AI clause in your engagement letter is a sensible place to say so.

What the Data (Use and Access) Act 2025 changed, and what it didn’t

We searched the Act’s full text on legislation.gov.uk for a new test of when information is personal data. There isn’t one. Article 4(1) still covers an “identified or identifiable natural person”, and Article 4(5) on pseudonymisation is untouched. No relative, holder-by-holder test has been written into UK law.

What the Act did was name pseudonymisation as a safeguard in two new UK GDPR articles, both fully in force since 5 February 2026. I find that telling: Parliament wrote the technique into the rules on reuse and research and left the definition of personal data alone.

The regulator changed shape too. The Information Commission took over the Information Commissioner’s functions on 30 September 2026, and it still publishes guidance under the ICO name. Its pseudonymisation guidance carries a banner saying it is under review after the Act. Firms with EU clients face a different set of rules again.

How to prep client text for AI without the names

The ICO’s data minimisation principle comes first: if the task doesn’t need a detail, it goes, not into a label. Labelling is for what the answer depends on, such as who wrote to whom. The order matters to me: delete first, label second.

Then check the file itself. A Word or PDF file can carry an author’s name in its metadata, which no label in the body touches.

A black box drawn over a PDF can leave the text underneath it, readable by anything that extracts text. That is what proper PDF redaction is for.

Settings decide what happens after you paste. Gemini’s data handling depends on the account type you use.

The same goes for Claude’s training settings, which differ between consumer and commercial plans.

Copilot and confidential information gets its own guide. None of those settings changes what the labels left behind in the text.

Holding the additional information yourself when text goes to AI

For prompts, the cleanest arrangement keeps the second output on the computer where the text was written. Nonimo for UK offices replaces names and numbers in the selected text with labels before it reaches the assistant, and puts the originals back in the reply. The record of which label is whom stays on that machine.

In UK GDPR terms, the text you send is still personal data in your hands. That is the honest label for your DPIA, and the reason deleting a conversation later is no substitute: a deleted ChatGPT chat disappears from view while the provider’s copy follows its own timetable.

Insurers ask about this now, so have an answer ready for the AI questions on a proposal form. This is a reading of published law and guidance, not advice on your own dataset.

If a labelled file does leak, the policy wording matters: cyber cover for UK small businesses treats data incidents in quite different ways.

Sources

• ICO, Pseudonymisation: two outputs; personal data for whoever holds the additional information and possibly anonymous for a recipient without it; techniques, attacks, organisational measures, breaches, and the review notice after the 2025 Act.
• ICO, Can we identify an individual indirectly?: combinations of age, occupation and residence; the determined person; the two-folder HR example.
• UK GDPR, Article 4 (legislation.gov.uk): the definitions of personal data in 4(1) and pseudonymisation in 4(5), and the Commission in (A2A).
• Data Protection Act 2018, section 171 (legislation.gov.uk): the re-identification offences, the meaning of de-identified, the defences, and “investigating” inserted from 5 February 2026.
• DSIT, Data (Use and Access) Act 2025: plans for commencement (GOV.UK): most Part 5 changes from 5 February 2026; the Information Commission from 30 September 2026.
• NCSC, Password administration for system owners: salt before hashing, against brute force and rainbow tables.
• OWASP, Password Storage Cheat Sheet: unique salts, and a pepper stored separately from the database.

Accessed 8 November 2026.