{"id":7310,"date":"2018-03-28T00:00:00","date_gmt":"2018-03-28T00:00:00","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/2018\/03\/28\/how-pseudonymization-can-help-you-comply-with-gdpr\/"},"modified":"2021-01-28T16:21:55","modified_gmt":"2021-01-28T16:21:55","slug":"how-pseudonymization-can-help-you-comply-with-gdpr","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/networks\/how-pseudonymization-can-help-you-comply-with-gdpr\/","title":{"rendered":"How Pseudonymization Can Help You Comply with GDPR"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n<\/p>\n

<\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n

Pseudonymization is one strategy that could help businesses struggling to comply with the European Union’s General Data Protection Regulation (GDPR)<\/a>.<\/p>\n

GDPR goes into effect on May 25, bringing with it stringent new data privacy protections for companies with European customers \u2013 and steep penalties for failing to comply with those regulations.<\/p>\n

One recent report found that a quarter of U.S. companies aren’t sure if they’re ready to meet GDPR compliance standards. “The challenge is due in part to confusion on behalf of many companies, primarily because there is not one software solution to buy that can help each corporation comply with the standard,” said Kory Willis, senior director of IT at partner relationship management (PRM) provider Impartner. “Rather, it is up to each company to make sure that each technology vendor they use can comply with the standard.”<\/p>\n

Indeed, there are a number of technologies that can help companies comply with GDPR<\/a>, among them data protection, managed file transfer, data mapping, privacy impact assessments, and individual rights compliance tools.<\/p>\n

But Willis says the key to complying with GDPR is pseudonymization.<\/p>\n

What is pseudonymization?<\/h2>\n

Pseudonymization is a form of data masking. It refers to a safeguard that can render a user’s personally identifiable data, well, less personally identifiable.<\/p>\n

The term can be found within the text of the law itself. Here’s how Article 4 of the GDPR<\/a> defines pseudonymization:<\/p>\n

“‘[P]seudonymization’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”<\/p>\n

It’s a mouthful, but what does it mean for data controllers and IT teams?<\/p>\n

“Simply put, pseudonymization means storing an individual’s information in many separate files, under many different names, so that no hacker could ever grab one file and have anyone’s full information,” Willis said. “If your information isn’t pseudonymized, you’re not compliant, and you could face huge consequences in just a few short months.”<\/p>\n

If a user’s data record is pseudonymized, one file would not yield an attacker enough information to complete the user’s record. Data must be stored in more than one data repository so an individual’s total set of details would be protected if one file of information is ever breached, Willis said.<\/p>\n

Pseudonymized data is different from anonymized data in some crucial respects.<\/p>\n

Anonymous data is irreversibly altered so that the “data subject is not or no longer identifiable,” states GDPR Recital 26<\/a>, one of 173 such sections outlining the thinking behind the law. In short, there is no way of reassembling a user record if it’s anonymized and therefore GDPR does not apply to the processing of such information used for research purposes. Pseudonymized data, however, may be reassembled with the use of a key or other additional information.<\/p>\n

It seems fairly straightforward, but Willis cautions that organizations that aren’t already pseudonymizing user data will face some added complexity implementing the privacy-enhancing procedure. It’s not completely foolproof; there’s still the risk of a persistent attacker being able to piece together a record if lax safeguards and security policies expose pseudonymization keys. But if properly used alongside data encryption<\/a>, it can go a long way toward ensuring GDPR compliance.<\/p>\n

How to implement pseudonymization<\/h2>\n

Pseudonymization involves much more than masking data on a technical level, Willis said. Here are some tips for IT teams looking to implement pseudonymization.<\/p>\n