Standard
Pseudonymization and Anonymization Standard
This standard defines pseudonymization and anonymization techniques permitted in the organization, the requirements for each technique, and the re-identification risk assessment that determines whether a data set has crossed from pseudonymous (still personal data) to anonymous (no longer personal data). It supports lawful data minimization, secure analytics, AI training data preparation, research, and cross-border transfer scenarios.
- Type
- Standard
- Version
- 1.0.7
- Date
- 2026-07-10
- Owner
- Data Protection Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Privacy
- Review frequency
- Annual and upon material cryptographic, statistical, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Permitted techniques
- 5. Requirements
- 6. Risk classification thresholds (default)
- 7. Operating expectations
- 8. Framework alignment
- 9. Limitations
Frameworks it maps to
- GDPR
- UK GDPR
- ISO/IEC 20889:2018
- ISO/IEC 27559:2022
- NIST SP 800-188
- NIST SP 800-226
- Article 29 Working Party Opinion 05/2014
- EDPB Opinion 28/2024 (December 2024)
- ENISA
Related documents
- Privacy and Data Governance Policyprivacy
- Data Classification and Handling Standardsecurity
- Encryption and Key Management Policysecurity
- Privacy Impact and Cross-Border Transfer Procedureprivacy
- AI System Impact Assessment Procedureai
- Records Retention and Destruction Standardgovernance
Next
All Documents