Pseudonymization

Applies to. PCI DSS v4.0.1 does not use the term; it comes from privacy law, chiefly the GDPR. The standard's own form of the idea is the index token, one of the four methods Requirement 3 accepts for rendering stored PAN unreadable, and the test for any pseudonym is the same: if the entity can reverse it, the PAN is still stored and Requirement 3 governs how it is protected. Scope under the standard turns on the PAN, so pseudonymising a cardholder's name or address changes nothing unless the PAN is dealt with too.

Limits. Pseudonymisation in the GDPR sense is a privacy measure and earns nothing under PCI DSS on its own; for stored PAN only the four Requirement 3 methods count.