Anonymization & Pseudonymization UI in Figma

Quick answer

Anonymization and pseudonymization UI lets teams strip or replace direct identifiers before data moves to analytics, support, or research—while keeping reversible keys locked behind strict access. Design an admin de-identification hub with pseudonym key vaults, rotation schedules, re-identification risk scores, and release gates that block exports until thresholds pass. Start from the Figma guides hub and pair with privacy-preserving analytics, ROPA mapping, data retention, compliance exports, and Dev Mode handoff.

Who this is for

Product designers building admin privacy tooling, data pipeline dashboards, and researcher access portals.
Privacy and data engineers configuring tokenization, hashing, salt rotation, and k-anonymity checks before dataset release.
Legal and compliance teams separating pseudonymized processing (still personal data) from true anonymization (out of scope).

De-identification policy hub (admin overview)

DeIdHub — Acme App · 38 active datasets · Policy v2.4 · Last key rotation 6d ago
├── Header: 4 datasets blocked · 2 keys expiring in 7d · Re-ID risk: 1 high · 0 critical
├── Actions: [ New dataset policy ] [ Rotate keys ] [ Run risk scan ] [ Audit access ]
├── Tabs: Datasets · Key vault · Rotation · Risk scores · Releases · Incidents
├── Alert: Dataset "Support transcripts Q2" · Risk HIGH · Quasi-IDs: zip + age + plan
├── Filters: Environment · Dataset · Method (hash|token|aggregate) · Owner team
└── Link: [ROPA](/designing-records-of-processing-activities-and-data-mapping-ui-in-figma/) · [Analytics policy](/designing-privacy-preserving-analytics-and-aggregation-controls-ui-in-figma/) · [Retention](/designing-data-retention-policies-and-auto-deletion-ui-in-figma/)

Section	Purpose
Datasets	Source tables, fields, and applied de-ID method per column
Key vault	Pseudonymization keys, salts, HMAC secrets—access logged
Rotation	Scheduled and emergency key rotation with re-hash jobs
Risk scores	Re-identification probability before release
Releases	Approvals to share with analytics, ML, or third parties
Incidents	Key leak, failed rotation, dataset linked back to users

Verdict: Pseudonymization fails when the reversal key sits in the same S3 bucket as the pseudonymized export—design UI that enforces separation and access tiers.

Dataset policy editor (field-level controls)

DatasetPolicy — user_events_raw → user_events_pseudo · Draft v2.4
├── Source: Production events · 14 columns · Owner: Data platform
├── Column rules:
│   ├── user_id → Pseudonymize · HMAC-SHA256 · Key: pseudo_v3 · ✓ Reversible with vault role
│   ├── email → Drop · Never copy to pseudo dataset
│   ├── ip_address → Truncate /24 · Not reversible · Quasi-ID flag: medium
│   ├── city → Generalize to region · Rollup table linked
│   ├── session_id → Tokenize · Key: session_v2 · Rotate every 90d
│   └── user_agent → Hash · Salt: ua_salt_v1 · No reversal
├── Release rules:
│   ├── Block export if re-ID risk > 0.05 without privacy officer approval
│   ├── Require k≥50 on any exported breakdown · Link [analytics policy](/designing-privacy-preserving-analytics-and-aggregation-controls-ui-in-figma/)
│   └── ML training: separate approval · [AI opt-out](/designing-ai-training-opt-out-and-model-data-usage-transparency-ui-in-figma/) filter applied
├── Key access: pseudo_v3 · Roles: deid_admin, break_glass · MFA required
└── [ Save draft ] · [ Simulate risk ] · [ Publish ] · Effective after nightly ETL

Design per-column badges: Drop, Pseudonymize, Tokenize, Generalize, Hash—each with tooltip explaining reversibility.

Re-identification risk dashboard

RiskScan — user_events_pseudo · Scan run 2026-08-12 02:00 UTC
├── Overall risk: MEDIUM (0.031) · Threshold: 0.05 for auto-release
├── Quasi-identifier analysis:
│   ├── Region + plan + signup_week · Unique combo rate 0.8% · ⚠ Review
│   ├── Age bucket + gender · k-min 47 · Below k=50 · 🔒 Block breakdown
│   └── Device class only · k-min 12,400 · ✓ Safe
├── Attack simulation: Journalist + public voter roll · Estimated match 0.02% · ✓
├── Recommendations:
│   ├── Merge signup_week → signup_month
│   ├── Drop gender or increase bucket width
│   └── Add noise before researcher export · Link DP settings
├── History: Risk was HIGH (0.061) before region rollup · Fixed in v2.3
└── [ Approve release with conditions ] · [ Block ] · [ Request privacy review ]

Analysts need actionable fixes, not a single red number—show which column combinations drive risk.

Key vault and rotation UI

KeyVault — Pseudonymization keys · MFA session active · Expires in 12m
├── Keys:
│   ├── pseudo_v3 · Active · Created 2026-02-01 · Next rotation 2026-05-01 · 14 datasets
│   ├── pseudo_v2 · Deprecated · Re-hash job 98% · Do not use for new data
│   └── session_v2 · Active · Auto-rotate every 90d · Last rotation 2026-07-15
├── Actions per key: [ Schedule rotation ] [ Emergency rotate ] [ View access log ]
├── Rotation wizard:
│   ├── Step 1: Generate pseudo_v4 · HSM-backed · No key material in UI
│   ├── Step 2: Dual-write period 14d · Old + new hashes accepted
│   ├── Step 3: Backfill job · Est. 6h · Progress bar in hub
│   └── Step 4: Revoke pseudo_v3 · Audit entry required
├── Access log: 12 views last 7d · 2 break-glass events · [Export for audit](/designing-audit-log-and-security-activity-ui-in-figma/)
└── Warning: Downloading raw keys disabled · Use API with scoped token only

Never show full key strings in Figma handoff—use placeholders and document API-only retrieval.

Researcher / third-party access portal

ResearchAccess — Request dataset: user_events_pseudo (aggregated)
├── Requester: University study · IRB #2026-441 · Contract on file
├── Dataset version: v2.4 pseudo · Aggregated only · No row-level export
├── Included: Region, plan, feature adoption counts · k≥100 enforced
├── Excluded: Any reversible pseudo IDs · Free text · IP-derived fields
├── DPA status: ✓ Signed · [DPA hub](/designing-data-processing-agreements-and-subprocessor-management-ui-in-figma/)
├── Approval chain: Data owner → Privacy officer → Auto expiry 90d
├── Download: Watermarked CSV · Expires 72h · Access logged
└── [ Submit request ] · [ View past grants ] · Revocation propagates in 24h

Third-party access needs expiry, watermarking, and revocation visible in the UI—not buried in legal PDFs.

Comparison: pseudonymization vs anonymization

Method	Reversible?	Still personal data?	Typical UI control
Pseudonymize (keyed)	Yes, with vault role	Yes (GDPR)	Key vault + access log
Tokenize (random ID)	Yes, lookup table	Yes	Token map + rotation
Hash (salted, no key)	No practical reversal	Often still personal if linkable	Salt rotation only
Generalize / bucket	No	Depends on k	Rollup rules + k check
True anonymization	No	No (if robust)	Release gate + risk scan
Drop field	N/A	N/A	Column drop rule in policy

Handoff checklist (Dev Mode)

DeIdDataset — dataset_id, source, target, policy_version, owner_team.
ColumnRule — column, method (drop|pseudo|token|hash|generalize), key_ref, reversible bool.
PseudonymKey — key_id, version, rotation_schedule, status, datasets_bound[].
RiskScan — scan_id, overall_score, threshold, quasi_id_findings[], blocked bool.
ReleaseApproval — release_id, approver_roles[], conditions[], expiry_at.
KeyAccessLog — actor, key_id, action, break_glass bool, mfa_verified.
Accessibility — risk level not color-only; method badges have text labels; rotation progress announced.

Common mistakes

Mistake	Why it hurts	Fix
Calling hashed email “anonymous”	Still identifiable with salt leak	Label pseudonymized; run risk scan
Keys in same bucket as data	Single breach re-identifies all	Separate vault; UI shows topology
No rotation UI	Stale keys widen blast radius	Schedule + emergency rotate flows
Row-level pseudo export to researchers	Easy join back with public data	Aggregate-only release tier
Ignoring quasi-identifiers	Zip + age + gender re-identifies	Risk dashboard with column combos
Skipping dual-write on rotation	Broken joins during migration	Wizard with progress and rollback
Same key for prod and staging	Test leak compromises prod	Environment badges on keys
Hiding reversibility from admins	Wrong legal basis assumed	Per-column reversible badge

Recommended workflow

Map fields in ROPA—document which columns are direct IDs vs quasi-IDs (ROPA UI).
Design dataset policy editor with per-column method and key binding.
Add risk scan gate before any release to analytics or ML—link privacy-preserving analytics.
Build key vault UI with rotation wizard and access audit—not downloadable secrets.
Create researcher request flow with approval chain, expiry, and watermark.
Align retention—pseudo datasets inherit auto-deletion rules.
Review at launch via privacy-by-design gates for new event properties.

FAQ

Pseudonymization vs data portability export?

Portability returns user’s own identifiable data; pseudo datasets are internal and must not include reversible IDs in third-party releases.

Same as privacy-preserving analytics?

Analytics UI controls display thresholds; de-ID UI controls pipeline transformation before data reaches warehouses.

When is data truly anonymous?

Only after risk scan passes your documented threshold and legal confirms—UI should say “anonymized release candidate,” not guarantee anonymity in copy.

Employee analytics?

Workforce data often stays pseudonymized with HR-controlled reversal—separate policy templates and stricter vault access.

Breach involving pseudo keys?

Trigger incident runbooks and force emergency rotation from vault UI.

Next steps

Design privacy-preserving analytics and aggregation controls UI in Figma — suppress small cohorts in dashboards
Design records of processing activities and data mapping UI in Figma — document de-ID activities
Design data retention policies and auto-deletion UI in Figma — expire pseudo datasets on schedule
Design compliance exports and legal hold UI in Figma — legal holds pause deletion jobs
Design privacy by design launch gates and feature privacy review UI in Figma — review new fields before logging

Designing anonymization and pseudonymization controls UI in Figma: keys, rotation, and re-identification risk