Swap direct identifiers for keyed pseudonyms

How to do it

Use HMAC-SHA-256 with a key held as Keep encryption keys in a key service describes. A plain hash of an email can be reversed by hashing a list of addresses. Pseudonymised data is still personal data, as the EDPB guidelines on pseudonymisation state, so the other rules in this chapter still apply. Looking a person up again for a support case goes through a separate tool that logs each lookup, as Log who reads personal data says. Analytics events follow Keep personal data out of events.

Examples

Python example

import hashlib
import hmac

def pseudonym(key: bytes, identifier: str) -> str:
    return hmac.new(key, identifier.strip().lower().encode(), hashlib.sha256).hexdigest()

JavaScript example

import { createHmac } from 'node:crypto';

export const pseudonym = (key, identifier) =>
  createHmac('sha256', key).update(identifier.trim().toLowerCase()).digest('hex');

How to check

A query over every text column in the warehouse finds no value containing @ and no account ID as stored in the app. The key exists in the key service and in no warehouse table or pipeline setting.

Sources

• GDPR Article 4(5), definition of pseudonymisation
• EDPB Guidelines 01/2025 on Pseudonymisation

Related rules

• INF-28 Keep encryption keys in a key service in Infrastructure and environments
• DAT-34 Log who reads personal data in Data and databases
• DAT-51 Keep personal data out of events in Data and databases