First of all, the GDPR doe not require you to pseudonymize anything. It requires that "appropriate" security measures be used. It also required that when Personal Data (which I shall call PI) is processed (which includes storing PI) that there be a lawful basis, as described in GDPR Article 6. The person's consent is one of the six possible lawful bases.
Second, while using pseudonymous data may be a good security practice, and is recommended by the GDPR, such data is still PI (and often PII, Personally Identifiable Information) and still requires a lawful basis for any processing. PI also requires that the Data Subject (DS) be notified when it is collected (Article 13 and Article 14, and that the DS has the "right to Know" (Article 15), "right to modify" (Article 16), and "right of erasure" (Article 17), and proper security must still be used on pseudonymized PI.
To convert PI into something that is not PI, where these rights and requirements do not apply, the data must be so modified that it is not reasonably possible, given current technology, to re-associate the modified data with the person that they represent, either directly or with the assistance of other data held by others than the Data Controller (DC). It must also not be possible to "single out" the DS. That is, if you suspect that the DS is a specific person X, it must not be possible to confirm this using the modified data. A hash, for instance, is not good enough, because if you suspect a particular person, you can hash that person's info and compare, and if you are correct there will be a match. If you can eliminate many of the possible suspects, leaving a much smaller pool, that is also singling-out, and means that the data has not been successfully anonymized. Data so modified is said to be anonymized, not just pseudonymous. Data that has been successfully anonymized is not subject to the security or notification requirements of the GDPR.
The GDPR does not specify any particular methods that may be used to anonymize PI. Certainly anything that leaves a recognizable name in the modified data is not good enough. Even recognizable initials would mean that the modified data has not been anonymized. Because that would allow someone the drastically limit which of a group of suspected people the PI belongs to. That is "singling out".
It should be assumed that an attacker knows any and all algorithms used to anonymize data, and if the attacker can re-identify or single-out the DS with this knowledge, plus other potentially available information, then the data has not been successfully anonymized.
To judge if an algorithm successfully anonymizes data, one would need the details of the algorithm, and an idea of other information which might be available to use in re-identifying the data. To anonymize data is not a simple or trivial task, and any DC who depends on it must be prepared to demonstrate that there is no reasonable way to re-identify or single out the DS from the anonymized data,
Nor does the GDPR ever require anonymization. If the DC abides by the requirements in handling PI and PII, there is no need for it at all.