Perspective also matters
A dataset may still contain personal data for the organisation with access to the linking key, while appearing effectively anonymous to a service provider without that access. The decisive factors are the means actually available and the specific access situation.
Cloud outsourcing requires more than a key
Alongside technical separation, roles, permissions, additional data, recipient groups and transfers abroad must be assessed. Contractual and organisational measures also determine how robust pseudonymisation is in the specific model.
- Effectively separate keys from pseudonymised data
- Realistically assess the access capabilities of all parties
- Consider additional data that can be linked and new analytical methods
- Periodically reassess risks and safeguards
Data protection as an ongoing task
Generative AI and powerful data analytics lower the barriers to linking and re-identification. A one-off classification is therefore insufficient: technology, the data environment and access conditions must be monitored throughout the processing lifecycle.