Pseudonymisation

Pseudonymisation means replacing direct identifiers in personal data, such as names, ID numbers or email addresses, with a code, number or pseudonym. The information linking the code to the person (the key) is kept separately and securely. Assigning codes such as “P-0247” to patients in a clinical study, or replacing customer names with random numbers in an analytics dataset, are examples.

Legal Nature

As long as the key is kept, the person can be re-identified. Pseudonymised data therefore remains personal data. The KVKK does not define pseudonymisation separately; the GDPR expressly states that pseudonymised data is personal data and refers to pseudonymisation as an appropriate security measure. The result is the same under Turkish law: pseudonymised data is subject to the legal bases for processing, notice, transfer and all other KVKK obligations.

As a Security Measure

Pseudonymisation does not replace KVKK compliance, but it is one of the technical measures that significantly reduce risk:

• It prevents employees in analytics, reporting and software testing environments from seeing direct identifiers,
• It limits the value of, and harm from, information affected in a data breach,
• It helps apply the principles of proportionality and data minimisation.

Protecting the Key

The effectiveness of pseudonymisation depends on protecting the key. The key should be kept separate from the pseudonymised data, access restricted to a small number of authorised people and access logged. Where the key is also permanently destroyed, the data may become anonymous, but re-identification risk must be assessed separately.