Pseudonymising coaching data: here's how to approach it

Pseudonymising coaching data: here's how to approach it

Pseudonymising means that in your coaching data you replace the name and other direct identifiers of a coachee with a code. You keep the link between the code and the name separately and well secured. Anyone who sees your notes does not immediately see who they are about. But keep this in mind: pseudonymised data still falls under the GDPR, the European privacy law. In this article you will read what pseudonymising does and does not do, where it makes sense in a coaching practice, and how to approach it step by step. You don't need any technical knowledge for it.

In short

• Pseudonymising reduces the risk if notes end up in the wrong hands. It does not make data anonymous.
• As long as you or someone else can link the code back to a person, the GDPR continues to apply.
• Start with an overview: where do names and recognisable details appear in your intake, notes, goals, check-ins, and reports?
• Keep the linking list with codes and names separate from your notes. Give access to as few people as possible.
• Pseudonymising does not replace a privacy policy, retention periods, good security, or a data processing agreement.

Table of contents

• What pseudonymising exactly is
• Why this matters especially for coaches
• Where is recognisable data in your practice?
• Step-by-step plan: pseudonymising in a small coaching practice
• Which method suits you?
• Common mistakes
• How we view pseudonymising
• A safe place for your coaching trajectories
• Frequently asked questions
• Sources

What pseudonymising exactly is

According to the GDPR, personal data is all information about a person whom you can recognise directly or indirectly. This is stated in the text of the GDPR at the Dutch Data Protection Authority. A name is directly recognisable. But a job title, an employer, and a move taken together can also make someone recognisable.

When pseudonymising, you remove the direct identifiers and replace them with a code. "Anna de Vries, team leader at a healthcare institution in Zwolle" then becomes, for example, "C-7Q4K". You keep the list that says C-7Q4K is Anna in a different place. The Dutch Data Protection Authority therefore calls pseudonymising a security measure that reduces the impact of a data breach. Anyone who sees the data finds it harder to trace it back to a person.

In January 2025, the European privacy supervisors, together the EDPB, published guidelines on pseudonymisation. They were adopted on 16 January 2025 as a version open for public consultation. The key point for coaches: pseudonymised data remains personal data, even if the linking list is held by another party.

Pseudonymising or anonymising?

These two words are often used interchangeably, but they mean something different. The EDPB explains it this way: pseudonymisation makes the link to a person harder, without breaking it entirely. With anonymising, you can no longer trace the data back.

For a coach with ongoing trajectories, true anonymising is rarely useful. You want to be able to link session three to session one. Pseudonymising is then the middle ground.

Why this matters especially for coaches

Coaching conversations often cover more than work goals. A coachee talks about burnout, a divorce, sleep problems, or a conflict with a manager. Data about health is part of the special categories of personal data under the GDPR. Stricter rules apply to these. Even without such topics, coaching notes are confidential. They contain doubts, weaknesses, and plans that someone does not want to share with their employer.

This is exactly where pseudonymising helps. Suppose your laptop is stolen or a shared folder is accidentally left open. If the notes contain only codes and the linking list is somewhere else, the damage to your coachee is smaller. The EDPB writes in the summary of the guidelines that pseudonymisation can help with security, with building privacy in from the start, and with using as little data as possible.

One caveat, though. According to the EDPB, pseudonymisation is not a general obligation. Whether it is necessary depends on what you process, how much, for what purpose, and with what risk. A solo coach with ten coachees is in a different situation than a practice with six coaches and a sponsor who receives reports.

Where is recognisable data in your practice?

Before you replace anything, you need to know where names and recognisable details appear. For most coaches, that's more places than they think. Go through this overview.

Also look at what is scattered outside your main system: loose Word files, photos of whiteboards, voice memos, and notes on your phone. In practice, that's where things most often go wrong.

Step-by-step plan: pseudonymising in a small coaching practice

In its report on pseudonymisation techniques, the European cybersecurity agency ENISA writes that no single method works in every situation. So start with your purpose, not with a technique. This step-by-step plan suits a solo coach or a small practice.

1. Create an overview. Use the table above. For each component, write down which data you record and why. Whatever you don't need, you no longer record from now on.
2. Determine who really needs the name. You as the coach usually do. A supervisor, a colleague who makes an analysis, or an assistant who handles the scheduling often does not. The fewer people who see the name, the better.
3. Choose a code that reveals nothing. Use a random combination, such as C-7Q4K. No initials, no date of birth, and no sequence number per month. "AdV-1985" is not a pseudonym, it's a hint.
4. Keep the linking list separate. Store the list of codes and names in a different place than your notes, with its own password. Give access only to yourself, or to the colleague who really needs it.
5. Also remove indirect identifiers. In your notes, replace the names of colleagues, the name of the employer, and unique details. "Her manager Pieter at the hospital in Deventer" becomes "her manager". Write down what you need for the coaching, not the whole story. You'll find more tips in our guide on writing session notes.
6. Limit access. Use a strong password and enable MFA on every system with coaching data. MFA means that when logging in, in addition to your password you complete a second step, such as a code on your phone.
7. Test whether your coachee remains recognisable. Read a pseudonymised note as if you were an outsider. Can you guess who it is? Then there are still too many details in it. The EDPB also recommends checking whether someone could still recognise a person without the additional information.

Afterwards, briefly write down what you have done and why. This helps when a coachee asks how you handle their data. Our GDPR checklist for coaches lists the other obligations. That way you can see where pseudonymising fits into the whole.

Which method suits you?

In its overview of techniques and best practices, ENISA mentions, among others, counters, random numbers, hash functions, and encryption. For a coach without a technical background, in plain language it comes down to this:

• A counter gives each coachee a sequence number: 001, 002, 003. That's simple, but predictable. Anyone who knows when someone started can guess the number.
• A random code is a string of characters with no meaning. For most coaches this is the best choice: easy to use and hard to guess.
• A hash is a calculation that always turns a name into the same code. That sounds handy, but anyone who knows or guesses the name can produce the same code. Without a secret key, this is not secure for small groups.
• Encryption makes data unreadable without a key. That's strong, but it's mainly something for your software, not for manual work.

An important consideration: as a coach you want to be able to link sessions together over time. But the more linking and detail you keep, the greater the chance that someone remains recognisable. So don't use the same code for different purposes. The code in your own notes does not have to be the same as the code in a case for peer supervision.

Common mistakes

• Thinking a code is enough. Does the note say "CFO of a well-known Utrecht insurer, just back from maternity leave"? Then the code helps little.
• Keeping the linking list next to the notes. An Excel file with codes in the same folder as the reports offers hardly any protection.
• Seeing pseudonymising as a free pass. The GDPR still applies. You still need a legal basis. You still have to inform coachees, apply retention periods, and respect their rights.
• Forgetting old files. Your new approach often only applies to new notes. Also look at your archive from recent years.
• Using AI tools with full names. Do you paste your notes with name and details into an AI chatbot? Then you share personal data with another party. Remove the names or use a tool that handles this for you.

Are you in doubt about whether you may record sensitive data, such as about health? Then seek advice from a privacy lawyer or a data protection officer, especially if you work with sponsors or employers.

How we view pseudonymising

We see pseudonymising as a useful part of working carefully, not as the solution for privacy. A coach who uses codes but keeps notes in a shared folder and in loose emails runs more risk than a coach who keeps everything in a well-secured place and records little.

That's why we have set up Exantur so that the basics are right. Data is stored on servers in Frankfurt, within the EU. Each practice is shielded from other practices. You log in with MFA and a data processing agreement is available. You record notes in a structured way, as observations, insights, breakthroughs, and action points. That helps you write down what you need for the coaching, instead of everything.

You see the same thinking in the optional AI assistant. It creates session summaries, preparations, and final reports based on your own notes, via your own Anthropic key. No data by which your coachee could be recognised goes to the AI model.

We'll say it honestly: software does not automatically make your practice GDPR-proof. You decide what you record, how long you keep it, and who may see it. We ensure that the environment in which you do this is secure and clear.

Martijn

A safe place for your coaching trajectories

Want to stop using loose documents, spreadsheets, and emails full of coaching data? In Exantur, the intake, session notes, goals, check-ins, assessments, and documents are kept with the right coachee and the right trajectory. Your coachee views goals, progress, check-ins, and shared documents in their own portal. You also track accountability between sessions: you can see whether someone is carrying out the agreed actions. The Mini subscription costs €19 per month or €190 per year, and you can try Exantur for free. View all subscriptions and prices, or first read how we have arranged security.

Frequently asked questions

Is pseudonymising mandatory for coaches?

No, there is no general obligation. According to the EDPB, it depends on the nature, scope, context, purpose, and risk of what you do with the data. Do you work with sensitive topics or share cases with others? Then it is a strong measure to reduce the risk.

Do pseudonymised notes still fall under the GDPR?

Yes. As long as someone with additional information, such as your linking list, can recognise the coachee, it remains personal data. So all GDPR rules continue to apply, including your coachee's right to access their data.

Can I discuss a case in peer supervision if I leave out the name?

Leaving out just the name is often not enough. Also remove or change the employer, job title, place of residence, and unique events. Ask yourself whether a colleague in the same region could recognise the person. State in your coaching agreement that you may discuss cases without recognisable data.

How long should I keep the linking list?

No longer than you keep the data itself. Has a trajectory been completed and the retention period passed? Then delete the notes and the link. Without a linking list the risk decreases, but also check that the notes themselves no longer contain recognisable details.

Sources

• Pseudonymising data, Dutch Data Protection Authority
• General Data Protection Regulation (GDPR), Dutch Data Protection Authority
• May you process personal data?, Dutch Data Protection Authority
• Guidelines 01/2025 on Pseudonymisation, EDPB
• Summary on pseudonymisation, EDPB
• Anonymisation and pseudonymisation, EDPB
• Pseudonymisation techniques and best practices, ENISA
• Report on pseudonymisation techniques (pdf), ENISA

Recommendations

• Writing coaching session notes, a practical guide
• Secure coaching software, EU-hosted, GDPR, RLS