Pseudonymization replaces identifying fields in a data record with artificial identifiers or pseudonyms.
However, unlike full anonymization, re-identification remains possible if the pseudonym can be matched with external or hidden reference data.
CRISC and privacy-risk guidance (aligned with GDPR principles) emphasize that:
"The primary concern when using pseudonymization as a privacy safeguard is the potential for re- identification of individual data subjects."
* Pseudonymized data can still be linked back to individuals if the mapping key or auxiliary datasets are compromised.
* True anonymization eliminates any reasonable means of re-identification, but pseudonymization does not.
* Therefore, while pseudonymization reduces exposure, it does not fully eliminate privacy risk.
Options A, B, and D are not inherent to pseudonymization:
* Authorized access and update restrictions are policy issues, not intrinsic to pseudonymization.
* Other information disclosure (D) could occur through inference but is secondary to direct re- identification.
Hence, C. Individual data subjects can be re-identified is the correct and verified answer as per CRISC and GDPR-aligned data protection practices.