5.1 What is meant by pseudonymised personal data?
Pseudonymisation means that personal data are processed in a way that they are no longer directly traceable to a specific data subject without additional information. Data that can be directly traced to a natural person (e.g. name and civic registration number) are deleted and exchanged for information that cannot be directly traced to this person. Complementary data (decryption key) are to be kept separate from the pseudonymised data. Pseudonymised personal data still constitute personal data and are thus subject to the GDPR as long as complementary data are stored somewhere which may be used to identify a specific natural person.

5.2 Is pseudonymisation the same as anonymisation?
Pseudonymisation means that a natural person is still identifiable with the application of additional information (e.g. a decryption key). Anonymisation in the context of the GDPR means that there is no such additional information. Anonymised data are not subject to the GDPR.

5.3 Indirect identification
Indirect identification means the identification of a natural person through a decryption key or via a combination of multiple variables, for ex. profession, health, municipality, gender, age etc. There are ways to mitigate the risk of indirect identification, such as by re-encoding variables so that age and income are stated within larger intervals and location within a greater geographical range. The indirect identifiers that need re-encoding depend on the type of data that have been collected.