- In order to be able to demonstrate compliance with the GDPR, the data controller should implement measures which meet the principles of data protection by design and data protection by default.
- Privacy by Design and by Default (Article 25) require that data protection measures are designed into the development of business processes for products and services. Such measures include pseudonymising personal data, by the controller, as soon as possible (Recital 78).
- Although the GDPR encourages the use of pseudonymisation to "reduce risks to the data subjects," (Recital 28) pseudonymised data is still considered personal data (Recital 26) and therefore remains covered by the GDPR.
- However, the notice to data subjects is not required if the data controller has implemented appropriate technical and organizational protection measures that render the personal data unintelligible to any person who is not authorized to access it, such as encryption (Article 34).
- Records of processing activities must be maintained, that include purposes of the processing, categories involved and envisaged time limits. These records must be made available to the supervisory authority on request.[24] (article 30).
https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
- Pseudonymization is a central feature of “data protection by design.”
- Companies that encrypt their personal data also gain the advantage of not having to notify data subjects in the case of a breach. (They still, though, would have to notify the local DPA.)
- Under Article 32, controllers are required to implement risk-based measures for protecting data security. One such measure is the “pseudonymization and encryption of personal data”
- The GDPR addresses the first concern in Recital 75, which instructs controllers to implement appropriate safeguards to prevent the “unauthorized reversal of pseudonymization.” To mitigate the risk, controllers should have in place appropriate technical (e.g., encryption, hashing or tokenization) and organizational (e.g., agreements, policies, privacy by design) measures separating pseudonymous data from an identification key.
https://iapp.org/news/a/top-10-operational-impacts-of-the-gdpr-part-1-data-security-and-breach-notification/
- In this regard, the GDPR expressly says that businesses should consider implementing “as appropriate … the
pseudonymisation and encryption of personal data.” While the law stops short of telling businesses they must
implement pseudonymisation, the express reference to pseudonymisation in the security provisions of the GDPR
is highly significant – indicating that, in the event of a security breach, regulators will take into consideration
whether or not a business had implemented pseudonymisation technologies. Businesses that have not may
therefore find themselves more exposed to regulatory action.
- if a data breach presents low risk to the individuals concerned, the GDPR’s breach notification
requirements become more relaxed. Pseudonymisation, whether through masking, hashing or encryption,
offers a clear means to reduce the risks to individuals arising from a data breach (e.g. by reducing the likelihood
of identity fraud and other forms of data misuse), and is supported by the GDPR as a security measure as
already described above.
http://www.directcommercemagazine.com/UserContent/doc/12624/delphix%20gdpr%20for%20data%20masking.pdf
** Tools **
- Data masking
https://www.mssqltips.com/sqlservertip/3091/masking-personal-identifiable-sql-server-data/
- Data encryption