Hashed Is Not Anonymous

An analytics pipeline replaces the email on every event before it lands in the warehouse, and the team marks the warehouse out of scope for the privacy program.

def pseudonymize(email: str) -> str:
    return hashlib.sha256(email.strip().lower().encode()).hexdigest()

# written to the warehouse
{"uid": pseudonymize(user.email), "page": "/checkout", "ts": 1786950000}

Is the warehouse out of scope?

Yes for the warehouse team, since they hold no mapping table. The Recital 26 test is applied to the party holding the data, so the same rows can be personal data upstream and anonymous here.

No. The transform is deterministic and unkeyed, so anyone with a list of candidate emails can recompute the digests and match them, and the controller still holds the user table that links the two. This is pseudonymisation, and pseudonymised data remains personal data.

Yes. SHA-256 is one-way, and the identifiability test in Recital 26 asks whether the transform can be reversed, which it cannot.

No, but only because of the timestamp. Hashing the email and coarsening ts to the day would put the dataset outside the Regulation.