Replacing an email with a hash feels like removing personal data and does not, because the same input always produces the same output and the input space is small enough to enumerate.
// pseudonymised — reversible with a rainbow table of every email
$id = hash('sha256', $email);
// still pseudonymised — reversible by whoever holds the key
$id = hash_hmac('sha256', $email, $key);
// anonymised — the link is gone because the mapping was destroyed
$id = bin2hex(random_bytes(16)); // stored, mapping deleted on erasureThe practical consequence is that pseudonymised data is still personal data and still in scope for access and erasure requests, so the hash does not remove the obligation. It does reduce risk meaningfully, which is a good reason to do it anyway. Anonymisation is only real when nothing anywhere can rejoin the record to a person, and a single foreign key elsewhere in the system undoes it.