Qualifying LLM tokenisation under the GDPR: pseudonymisation by default

Legal analysis of large language models (LLMs) tends to focus on personal data collection and lawfulness, overlooking a technical stage that conditions downstream risk: tokenisation. This article offers a doctrinal account of tokenisation under the General Data Protection Regulation (GDPR). Section 1 translates engineering into legal concepts: stable vocabulary files, normalisation rules and tokenizer metadata, plus ordered token-ID sequences that preserve a referable link to source strings under a fixed tokenizer version. Section 2 synthesises CJEU case law and regulatory guidance to refine the notion of identifiability and to distinguish pseudonymisation from anonymisation in context. Section 3 maps tokenisation to Article 4(2) GDPR operations and proposes a data controller decision test that classifies outputs ex ante. The core result is practical and normative: in typical LLM projects, token-ID sequences derived from inputs containing personal data should be treated, by default, as pseudonymised personal data for data controllers/processors – anonymisation being exceptional and requiring recipient-specific, evidence-based irreversibility.