The GDPR, in Article 4(5), explicitly defines pseudonymisation as "the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information." The definition crucially requires that this "additional information is kept separately and is subject to technical and organisational measures" to prevent re-identification. This technique reduces the risk to data subjects but does not render the data anonymous; it remains personal data and falls within the scope of the GDPR because re-identification is still possible.

B. This describes anonymization, where re-identification is rendered impossible. Pseudonymous data, by contrast, can be re-identified with the additional information.
C. This is the definition of anonymous data, as described in Recital 26 of the GDPR. Anonymous data is outside the scope of the regulation.
D. Encryption is a method that can be used to achieve pseudonymisation, but it is not the definition of the concept itself. Pseudonymisation is the outcome, not the specific technique.

1. General Data Protection Regulation (EU) 2016/679, Article 4(5): "'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person".

2. General Data Protection Regulation (EU) 2016/679, Recital 26: This recital clarifies the distinction with anonymization: "The principles of data protection should therefore not apply to anonymous information...or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable." This directly contradicts options B and C.

3. Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216), Section 3.2, Page 20: This opinion, which remains influential under the GDPR, states: "Pseudonymisation is a useful security measure, but it is important to note that pseudonymised data are still personal data and fall within the scope of the data protection framework." This supports the core concept that re-identification remains possible, distinguishing it from anonymization.