Pseudonymisation
Replacing direct identifiers with pseudonyms so data cannot be tied to a person without separately held additional information.
GDPR Article 4(5) defines pseudonymisation as processing such that data can no longer be attributed to a specific person without additional information kept separately under technical and organisational controls. Techniques: keyed hashing (HMAC with a secret key), tokenisation with a vault, or encryption.
Pseudonymised data is still personal data under GDPR; it reduces risk and earns regulatory credit, but obligations remain. Anonymised data, by contrast, falls outside GDPR, and the bar for true anonymisation is high.
The usual mistake is unkeyed hashing: SHA256(email) or a hashed phone number is reversible by hashing every plausible value. Others: keeping the key next to the data, using one pseudonym across all datasets so they can be joined, and leaving quasi-identifiers (postcode, birth date) untouched.