The Reversibility Requirement
GDPR distinguishes between anonymization (irreversible) and pseudonymization (reversible). Many use cases require pseudonymization: legal discovery, audit requirements, clinical trials, and research validation.
- Legal discovery blocked - Irreversibly anonymized data cannot be produced when ordered
- Audit gaps - Cannot demonstrate what was protected without reversibility
- Research limitations - Cannot validate findings or report adverse events
- LLM workflow breaks - AI responses with placeholders cannot be restored
Clinical Trial Adverse Event Reporting
Pharmaceutical companies must de-identify data for analysis, re-identify for adverse events (FDA requirement), and audit on demand. Without reversibility, FDA adverse event reporting becomes impossible.
Legal Discovery Requirements
Companies under litigation need to preserve original documents, create working copies for review, and produce specific documents when ordered. Irreversible anonymization means discovery obligations cannot be fulfilled.
Audit Trail Requirements
Regulators may ask to see exactly what PII was in a document and how it was protected. With irreversible anonymization, this cannot be demonstrated. Evidence-based compliance requires reversibility.
AES-256-GCM Reversible Encryption
cloak.business offers five anonymization methods including reversible encryption:
Replace
Substitute with fake data
Redact
Remove entirely
Mask
Partial obscuring
Hash
One-way transformation
Encrypt
AES-256-GCM, reversible
Technical Specifications
Reversibility Enables Compliance
| Scenario | Without Reversibility | With cloak.business |
|---|---|---|
| Legal discovery | Blocked | Supported |
| Adverse event reporting | Impossible | Compliant |
| Audit demonstration | Trust-based | Evidence-based |
| LLM workflow restoration | Broken | Functional |
Key Takeaways
- Irreversible anonymization blocks legal discovery - Courts may order original documents
- HIPAA explicitly permits pseudonymization - Re-identification key is allowed
- Clinical trials require re-identification capability - Adverse event reporting is mandatory
- Audit compliance requires demonstration - Show what was protected
- Reversible encryption is a unique differentiator - Most tools do not offer it