Before you paste customer data into an AI tool: a GDPR pseudonymisation check sheet (direct identifiers, quasi-identifiers, the key kept apart) for small businesses
What you get: a finished pseudonymisation check sheet in three tabs: a field list where you mark every column or text field of the data set you want to put into an AI tool as a direct identifier, a quasi-identifier or other data, with the action for each; a key and separation tab that records where the lookup table or secret key is kept, who can open it and who must not; and a result tab with a formula that tells you whether the file is ready, needs more work, or is still plainly identifying, plus four made-up example rows.
Short answer: replacing names with codes does not take data out of the GDPR. Recital 26 says personal data which have undergone pseudonymisation and "could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person". Pseudonymisation is still worth doing: it "can reduce the risks to the data subjects concerned" (Recital 28). For it to count as pseudonymisation under Article 4(5), the additional information (your code list or key) must be "kept separately" and protected by technical and organisational measures.
Why this matters before you use AI tools
Small businesses paste support tickets, CRM exports, call notes and staff spreadsheets into chatbots and AI analysis tools every day. Taking out names first is a good habit, but it is often done halfway: the email address stays in the signature, the order number stays in the subject line, or the town plus job title plus age still point to one person. The EDPB guidelines say the legal definition "requires a look at all parts of the personal data, not only the pseudonyms" (Guidelines 01/2025, para. 7). This sheet makes you look at every field.
Step 1: tab 1, field list (one row per column or free-text field)
| Column | What to write | Source |
|---|---|---|
| A. Data set and AI tool | For example "Helpdesk export Jan to Sep 2026 → AI summary tool" | |
| B. Field | Each column name, and each free-text field (message body, notes, call transcript) as its own row | EDPB Guidelines 01/2025 para. 7 ("all parts of the personal data") |
| C. Type | Direct (name, email, phone, customer or order number, national ID, IP address), Quasi (age, gender, job title, town, income, length of service and similar attributes that together may point to a person), or Other | Art. 4(1) GDPR (identifiers); Guidelines 01/2025 paras. 83, 101 |
| D. Action | Remove, Replace with code, Generalise (age 37 → 30-39, postcode → region), or Keep | Guidelines 01/2025 paras. 83, 102 |
| E. Needed for the AI task? | Yes or No. If No, the action is Remove | Art. 5(1)(c) data minimisation |
| F. Check | =IF(AND(C2="Direct",D2="Keep"),"FIX: direct identifier left in",IF(AND(E2="No",D2<>"Remove"),"FIX: not needed, remove it",IF(AND(C2="Quasi",D2="Keep"),"REVIEW: quasi-identifier kept","OK"))) | Formula is our working rule |
Free-text fields need a second look: names, phone numbers and addresses often sit inside message bodies and email signatures, not only in their own columns. Search the text for "@", digit runs and greeting lines before you mark a free-text row OK.
Step 2: tab 2, key and separation
Article 4(5) asks for three things, which the EDPB describes as three actions: transform the data, keep the additional information separately, and apply measures so the data are not attributed to people (Guidelines 01/2025, para. 5).
| Column | What to write | Source |
|---|---|---|
| A. Method | Lookup table (a list matching each code to the real name or ID) or keyed function (a code calculated with a secret key) | Guidelines 01/2025 paras. 88, 92 |
| B. Where the table or key is kept | For example "separate encrypted folder on the office drive, not in the AI tool, not in the shared export folder" | Art. 4(5) "kept separately"; Recital 29 |
| C. Who may open it | Roles, not names, if you share the sheet | Recital 29: "indicate the authorised persons" |
| D. Who must not see it | The people and tools that will work on the coded data (the AI tool and its vendor, the staff using the output) | Guidelines 01/2025 paras. 20, 35 (the "pseudonymisation domain") |
| E. Codes random or guessable? | Random, or Guessable (initials, date of birth, a plain hash of the email address). Guessable means FIX | Guidelines 01/2025 paras. 88, 89 (a secret with "sufficient entropy"; keyed one-way functions such as MACs); "Guessable" list is our working rule |
| F. Public sources checked? | Could someone match the coded rows with public posts, reviews or social media? Yes, No or Not checked | Guidelines 01/2025 para. 21 |
Step 3: tab 3, result
| Column | What it shows | Source |
|---|---|---|
| A. FIX rows in tab 1 | =COUNTIF(Tab1!F:F,"FIX*") | |
| B. REVIEW rows in tab 1 | =COUNTIF(Tab1!F:F,"REVIEW*") | |
| C. Result | =IF(OR(A2>0,Tab2!E2="Guessable"),"Not ready: still identifying",IF(OR(B2>0,Tab2!F2<>"No",Tab2!B2=""),"Needs work: check quasi-identifiers, public sources and key storage","Ready as pseudonymised data: still personal data under GDPR")) | Formula and thresholds are our working rule, not a legal test |
| D. Still to do | Even when ready: legal basis for the AI use, your processor agreement with the AI vendor, and whether the vendor trains on your data | Art. 6(1), Art. 28; Guidelines 01/2025 para. 23 (pseudonymisation is a safeguard, for example under Art. 25 or 32, not a legal basis) |
The best result the sheet can give is "pseudonymised", never "anonymous". The EDPB says that even if all the additional information has been erased, pseudonymised data "becomes anonymous only if the conditions for anonymity are met" (Guidelines 01/2025, para. 22), and Recital 26 asks you to consider "all the means reasonably likely to be used", taking into account cost, time and available technology. Anonymisation needs its own assessment.
Four made-up example rows
| Data set | Result | What happened |
|---|---|---|
| Web shop helpdesk export for an AI summary of top complaints. Names replaced with codes, but message bodies still had email signatures | Not ready: still identifying | Signatures and phone numbers stripped from the text field, then re-checked: Ready |
| Small accounting firm sends a staff overtime sheet to an AI analysis tool: codes instead of names, but job title, team and length of service kept | Needs work | In a 12-person firm those three fields point to one person; team and service length generalised to bands |
| Dental practice wants AI help to analyse appointment no-shows; codes were patients' initials plus birth year | Not ready: guessable codes | Switched to random codes in a lookup table kept on a separate drive only the practice manager can open |
| Agency feeds CRM deal notes to an AI forecasting tool: client company names kept, contact names and emails removed, random deal codes, table stored apart | Ready as pseudonymised data | Still treated as personal data: processor agreement checked and vendor training switched off |
These rows are made up for illustration and do not describe any real business.
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Article 4(1) and 4(5), Recitals 26, 28 and 29, as published on gdpr-info.eu) and EDPB Guidelines 01/2025 on Pseudonymisation, adopted on 16 January 2025 (paras. 5, 7, 20 to 23, 35, 83, 88, 92, 101 to 103). The PDF we read is marked "version for public consultation"; check the EDPB website for a later final version. The field types, actions, result formula and thresholds are our own working rules. Checked on 27 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Many client files you handle (payroll, invoices, bank exports) end up in AI tools. Give clients tab 1 before they paste anything: it takes ten minutes per data set and catches the identifiers left in free text. Stay inside your professional rules and refer legal questions on.
Keep the check next to your AI tool list
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, then attach this sheet as the evidence record for the data set it covers.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: Article 6(4) reuse check · Article 32 access security · Article 28 processor agreement · DPIA screening
Sources
- Article 4 GDPR (definitions 1 and 5), Recital 26, Recital 28, Recital 29; official text: Regulation (EU) 2016/679
- EDPB Guidelines 01/2025 on Pseudonymisation, adopted 16 January 2025, version for public consultation
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.