The line that decides everything
Under GDPR, one question decides whether the rules still apply to your data: can it still be tied back to a person?
If yes, it is pseudonymized, and it is still personal data. If no, it is anonymous, and the data protection principles stop applying.
What the regulation says
Article 4(5) defines pseudonymisation as processing personal data so that it "can no longer be attributed to a specific data subject without the use of additional information", provided that additional information "is kept separately and is subject to technical and organisational measures".
Recital 26 settles what that means. Personal data that has been pseudonymised "should be considered to be information on an identifiable natural person." And the principles of data protection "should therefore not apply to anonymous information", meaning data rendered anonymous so the person "is not or no longer identifiable."
Why this matters when you sell or share data
Most useful datasets keep people consistent. Customer 4471 bought twice. Patient 8812 came back in March. That consistency is what makes the data worth something.
It also means the data is pseudonymized, not anonymous. If a key exists that links the stand-ins back to people, you are still handling personal data, and you still owe GDPR's obligations on it.
So be careful with the word "anonymized" in contracts and sales decks. If your stand-ins are consistent and a key exists anywhere, the accurate word is pseudonymized.
Choosing between them
Choose pseudonymization when you need to follow the same person across records: repeat purchases, care over time, fraud patterns. Keep the key separate, locked, and out of the dataset you share.
Choose anonymization when no one downstream ever needs to tell people apart, and you can show that no one can be identified, alone or combined with other information.
The hard part is the names
Pseudonymization only works if the same person always gets the same stand-in. Real data rarely cooperates. "Maria Delgado", "M. Delgado" and "Mria" have to become one stand-in, or your counts break and versions slip through.
Where we come in
We pseudonymize or anonymize your data inside your own walls, link every version of a name to one stand-in, and leave the key with you. Book a review and bring a sample.
