What changes and what remains

Pseudonymisation processes data so that they cannot be attributed to a person without additional information, which must be kept separately and protected. One implementation uses codes instead of direct identifiers. The result is not automatically anonymous information: if the link can be restored, protection of personal data processing remains necessary.

Where it can help in OSH

It can reduce direct exposure of identities when analysing trends or conducting certain research work with appropriate safeguards. Its usefulness depends on who receives the dataset, what other data they know and its purpose. The technique does not itself authorise sharing clinical information or replace health data protection.

The correspondence table

If a table linking codes and identities is used, its access should be restricted and kept separate from the working dataset. Copies, exports and administrative permissions must also be considered. Sending the table with the coded file to the same recipient group can undermine the intended separation. Key and code management needs clear responsibilities and procedures.

Other fields can identify people

Removing the name is insufficient when unique combinations of job, workplace, age or the date of a known event remain. Free text and attachments can retain direct identifiers. The entire content and context of use must therefore be reviewed, not just the main column. The possibility of linkage should be assessed before distribution.

Example of limited use

In a hypothetical example, an authorised team studies a series of exposures using codes and variables needed for the analysis. Identification is retained through a separate process for actions that legally require it. Access to individual results is not widened simply because names in the analysis file have been replaced by numbers.

Limits and follow-up

Pseudonymisation is one measure within a set of safeguards, alongside minimisation, permissions and proportionate retention. Reidentification risks and changes in recipients or information sources must be checked. It does not permit declaring that the GDPR no longer applies or presenting coded data as suitable for open publication without further assessment.