Methods for protecting and pseudonymizing personal data in systems for forming cross–functional IT project teams

Abstract

The article presents a comprehensive analysis of the security requirements, methods, and technological tools for protecting personal data in human resource management systems and systems for forming cross–functional teams for IT projects. The main categories of data used to create professional profiles are identified, including identification data, professional experience, hard skills, soft skills, roles, assessment results, and information about participation in previous projects. The principal risks associated with unauthorized access, data breaches, excessive user privileges, re–identification of data subjects, and the use of personal information beyond the specified purpose of processing are systematized. Organizational and procedural protection mechanisms, technical means of authentication and authorization, role–based and attribute–based access control models, the principle of least privilege, activity auditing, Data Loss Prevention (DLP) mechanisms, and tools for monitoring operations involving personal data are examined. A comparative analysis of the main methods for transforming and de–identifying Personally Identifiable Information (PII), including masking, tokenization, pseudonymization, anonymization, and differential privacy, is conducted with regard to the level of confidentiality, the possibility of controlled re–identification, preservation of data structure, suitability for further analysis, machine learning, and data mining (DM), as well as the complexity of practical implementation. The study demonstrates that, for potential candidate profiles, it is essential not only to reduce the risk of disclosing users’ identities but also to preserve the analytical value of professional and behavioral characteristics required for candidate assessment and support of personnel–related decisions. The feasibility of using pseudonymization as a basic mechanism for separating the identification and analytical data–processing layers is substantiated. A conceptual approach to the creation and evaluation of a protected professional profile is proposed, in which direct personal identifiers are removed from the analytical layer and replaced with controlled pseudonyms, while professional characteristics, skills, experience, and role–related attributes remain available to algorithms for analysis and team formation. Particular attention is paid to the automated detection of PII using rules, regular expressions, Natural Language Processing (NLP) methods, machine learning, and combined mechanisms for identifying sensitive attributes.