Anonymisation vs Pseudonymisation Under the GDPR
Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Pseudonymisation, defined in Article 4(5), means processing personal data so that it can no longer be attributed to a specific person without additional information that is kept separately and protected. Anonymisation goes much further: identification must no longer be possible, taking account of all the means reasonably likely to be used. The consequence is decisive. Pseudonymised data remains personal data and stays fully within the GDPR, while genuinely anonymous data falls outside it under Recital 26 - and because anonymising is itself an act of processing, it needs its own lawful basis before you do it.
Anonymisation vs pseudonymisation at a glance
| Feature | Pseudonymisation | Anonymisation |
|---|---|---|
| Source in the law | Defined in Art 4(5); referenced in Arts 6(4), 25, 32, 34, 89 | Not defined in the articles; addressed in Recital 26 |
| Reversible | Yes, with the separately held additional information | No - if it can be reversed, it was never anonymisation |
| Still personal data | Yes | No |
| GDPR applies | In full - principles, rights, breach duties | Not to the anonymous output; it does apply to the act of anonymising |
| Typical techniques | Tokenisation, keyed hashing, encryption with a separately held key, reference numbers | Aggregation, generalisation, k-anonymity and its refinements, noise addition, differential privacy |
| Main use | A risk-reduction and security measure | An exit route from the regime, for statistics, research and publication |
| Main failure mode | Key or mapping table stored alongside the data | Residual singling out, linkage to an external data set, or inference |
What does Recital 26 require before you can call data anonymous?
Recital 26 sets a relative, evidence-based test rather than an absolute one. To decide whether a person is identifiable, you must take account of all the means reasonably likely to be used either by the controller or by another person, having regard to objective factors: the cost of identification, the time required, the technology available at the time of processing and foreseeable technological developments.
The Article 29 Working Party's Opinion 05/2014 on anonymisation techniques gives the working test still used today. A data set is only anonymous if all three risks are addressed:
- Singling out - can you isolate records relating to one individual?
- Linkability - can you link at least two records about the same person, within the set or across two sets?
- Inference - can you deduce, with significant probability, the value of an attribute from other values?
No single technique defeats all three in every context, which is why anonymisation is a risk assessment rather than a checkbox - and why it must be reviewed as auxiliary data sets and re-identification techniques improve.
Is hashed or encrypted data anonymous?
Almost never. Encryption where anyone still holds the key is pseudonymisation, not anonymisation: the key is precisely the 'additional information' referred to in Article 4(5). An unsalted hash of a value from a small or guessable domain, such as an email address or a national identity number, can be reversed by brute force, and even a salted hash still allows the same person to be linked across records, which fails the linkability test.
The CJEU's decision in Breyer (C-582/14) shows how the relative test works in practice: a dynamic IP address held by a website operator was personal data because the operator had legal means reasonably likely to be used to obtain the missing information from the internet service provider. The mirror-image question - whether pseudonymised data is personal data in the hands of a recipient who has no realistic route to the key - has been litigated in the EDPS v SRB proceedings, and the direction of travel is that identifiability is assessed by reference to the means reasonably likely to be available to the party actually holding the data. Neither line of authority lets you treat keyed data as anonymous while you still hold the key.
See also the notes on IP addresses as personal data.
Why pseudonymisation is still worth doing
Pseudonymisation does not take you out of scope, but the GDPR rewards it in five concrete places, and knowing them is worth marks and worth money.
- Article 25 - named as an example of data protection by design and by default.
- Article 32(1)(a) - named as an appropriate technical measure for security.
- Article 6(4)(e) - a factor when assessing whether further processing is compatible with the original purpose.
- Article 34(3)(a) - measures that render the data unintelligible to unauthorised parties can remove the duty to communicate a breach to affected individuals.
- Article 11 and Article 89 - support processing that does not require identification, and safeguards for archiving, research and statistics.
What it does not do is switch off the rights. If you can still link the data to a person with the information you hold, access, erasure and objection all continue to apply. See pseudonymisation for the definitional detail.
Related study notes
- Identifiability, Anonymisation and Pseudonymisation
- Module 2 · Anonymous vs pseudonymous data
- Personal Data and Its Four Building Blocks
- IP addresses as personal data (Breyer)
Frequently asked questions
Is pseudonymised data personal data?
Yes. Recital 26 states expressly that personal data which has undergone pseudonymisation, and which could be attributed to a person by the use of additional information, should be considered information on an identifiable natural person. It sits inside the GDPR in full.
Do I need a lawful basis to anonymise data?
Yes. Anonymisation is an operation performed on personal data, so it is processing under Article 4(2) and needs a basis, plus a compatibility assessment where it is a further use. The output is outside the regime, but the act of producing it is not.
Is encryption the same as pseudonymisation?
They overlap without being identical. Encryption is a security measure; it amounts to pseudonymisation when the decryption key is kept separately with technical and organisational measures preventing attribution. It is not anonymisation while a key exists anywhere.
Can data that was anonymous become personal data again?
If re-identification later becomes reasonably likely because of a new auxiliary data set or a better technique, the honest conclusion is that the data was not truly anonymous. This is why Recital 26 refers to foreseeable technological developments and why anonymisation claims should be re-tested periodically rather than certified once.
Test yourself
Try the free CIPP/E practice questions, or read the full CIPP/E study guide - free.