Pseudonymization, anonymization, sensitive data, and privacy-enhancing technologies
Whether data is personal decides whether privacy law applies at all — which makes the line between pseudonymization and anonymization one of the most consequential definitions in AI governance.
Why this matters for the AIGP exam
The exam tests the boundary precisely, because AI pipelines process personal data at a scale where getting it wrong compounds fast, and because bias testing needs the very categories of data privacy law restricts most.
The essentials
- Pseudonymized data is still personal data. Replacing identifiers with tokens reduces risk but stays inside the GDPR, because re-identification remains possible with the key.
- Anonymized data is outside the GDPR — but only if re-identification is not reasonably possible by anyone, a bar that rises as linkage techniques improve. Claimed anonymization that can be reversed is just pseudonymization with better marketing.
- Sensitive data and bias testing pull against each other. Testing a model for discrimination requires knowing protected attributes, and special-category data carries the tightest processing rules. Organisations resolve this with explicit legal bases, minimisation, and privacy-enhancing techniques rather than by skipping the testing.
- The main PETs to recognise: differential privacy (mathematical noise with a privacy budget), federated learning (training moves to the data), synthetic data (generated stand-ins), homomorphic encryption (compute on encrypted data), and secure multi-party computation.
What the exam asks
Classify a described dataset as personal, pseudonymized or anonymized; pick the PET that fits a stated constraint; and explain how a team can bias-test lawfully.
Going deeper
This page is the condensed version. The full topic — with the detail above expanded and practice questions attached — is in the app, inside Domain II. Domain I, a quarter of the course, is free to try first.
Back to the AIGP study guide.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.