According to the GDPR, how is pseudonymous personal data defined?

Pseudonymisation is a technique that replaces, removes or transforms information that identifies individuals, and keeps that information separate from the rest of the data. Pseudonymised data is still personal data under the GDPR, because it can be re-identified with the use of additional information. However, pseudonymisation can reduce the risks of processing personal data and help comply with data protection principles and obligations. Pseudonymisation is different from anonymisation, which is the process of irreversibly transforming personal data so that the data subject is no longer identifiable. References:

GDPR Article 4(5), which defines pseudonymisation.

GDPR Recital 26, which explains the difference between pseudonymisation and anonymisation.

EDPS blog post, which provides an overview of pseudonymisation and its benefits.

ICO guidance, which gives practical advice on how to implement pseudonymisation.