The GDPR Handbook for Concerned Marketing Teams pt. 2: Article 25, Pseudonymization & Data Deletion

Now that we covered the essentials of the GDPR (if you missed them, catch up here), let’s get into some specifics.

The topics we are going to cover in this article may seem very unrelated to marketing but bear in mind that, ultimately, it is brand trust that is at stake here.

Let’s start with the spooky Article 25, that states the need for privacy by design and default. This looks like the kind of complicated business only lawyers enjoy. Let’s break that down, shall we?


Privacy by design

Privacy by design simply means that, when you think of a data management solution, you should bear in mind the safety of the data you are collecting and take the careful and logical steps to make it inaccessible to people who shouldn’t access it in the first place. You should be able to demonstrate your compliance to users and the authorities, and this means you will have to document your entire data processing endeavours.


Privacy by design brings to the table a concept very dear to the legislation: pseudonymization. Its main goal is to change personal information so much that you can never trace it back to its original form (you close the door and throw away the key), by separating PII (Personal Identifiable Information) from non-PII, keeping them in different data silos.

On top of that separation, you still are highly recommended encrypt the additional information.

For instance, imagine you have a database with the fields “name”, “gender”, “year of birth” and “city of residence”. If you take away the field “name” and put it in another database, the remaining fields by themselves cannot identify a person (how many females born in 1982 live in London?).

When cookies join the equation things get a little trickier, which is why our next article will focus on that.

Privacy by default

This can be subsumed under the premise “what you sign for is what you get”. We’ve all been there: to sign up for a social media service, the required fields are name and e-mail. Once your profile is fully set up, the fields age and city of residence also show up publicly. Under the GDPR that is a breach of regulation, because all that they asked from you was your name and e-mail.

Data minimization, the notion that you should not collect more data than the one you really need, does play an important role here. Companies should begin data management procedures with this question: “What’s the absolute least information my company needs from a user?”. And then they have to stick to the answer to that question.

Data Deletion

The new legislation brings yet another relevant concept: that of the right to data deletion.

Though this right is not absolute, it does apply in certain situations. The most obvious ones are breach of the GDPR, legal obligation or if the user is underage.

But there are three other situations worthy of attention:

  1. When the data is no longer necessary for the purpose it was initially collected for;
  2. If the individual withdraws consent;
  3. When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.

The right to data deletion is something to bear in mind from the beginning of your data management strategy, not only because it rebalances a user right that was missing but also because it is deeply associated with brand trust issues.


So, this was the second part of our series of articles on the GDPR. Next time, we will be focusing on the root of all problems to a 2017 marketer: cookie management. We’ll keep it nice and easy, don’t worry.


This post is meant to showcase some information on the GDPR but it does not substitute for a legal team. Please make sure that you have consulted with your legal department before you take any action regarding the implementation of this regulation.
2017-07-27T15:42:18+00:00 July 27th, 2017|First-Party Marketing, Marketing|