Pseudonymization vs Anonymization: Definitions, Differences and the GDPR

Pseudonymization and anonymization are often confused.

They protect data in two very different ways.

And the GDPR does not treat them the same way.

What is pseudonymization?

Pseudonymization means replacing the data that identifies a person with a pseudonym.

The GDPR defines it in Article 4(5): processing personal data so that it can no longer be attributed to a specific data subject without the use of additional information.

That additional information must be kept separately and protected by technical and organizational measures.

Two kinds of pseudonym are common:

1. A realistic pseudonym.
   John Carter becomes another plausible name, and the document still reads naturally.
2. A constant identifier.
   John Carter becomes PERSON_7b94f21c, and the same identifier comes back everywhere John Carter appears.

In both cases, you can still follow the same person through the data without knowing who they are.

What is anonymization?

Anonymization makes identifying a person impossible, irreversibly.

The name becomes [PERSON], for example, or an opaque black box in a PDF.

No additional information allows anyone to go back.

Anonymization vs pseudonymization: the difference

	Pseudonymization	Anonymization
Link to the person	Possible, with information kept separately	Impossible
Reversible	Yes, for whoever holds that information	No
Status under the GDPR	Personal data	Outside the scope of the GDPR
Follow the same person	Yes	No

Key point:
Pseudonymized data is still personal data. Anonymized data is not.

US privacy laws draw a similar line between personal information and de-identified data, each with its own definition.

Pseudonymization and the GDPR

The GDPR encourages pseudonymization.

It names it as a measure for data protection by design (Article 25) and for security of processing (Article 32).

But pseudonymizing does not take data out of the GDPR:

1. Processing still needs a legal basis.
   Pseudonymized data still relates to people.
2. Individuals’ rights still apply.
   Access, rectification, erasure: nothing changes.
3. The additional information must be protected.
   It is what allows the identity to be recovered, so it must be stored separately, with restricted access.

Only anonymization takes data outside the scope of the GDPR (Recital 26).

Pseudonymized for whom? Re-identification and the recipient

A common question: is pseudonymized data personal data for everyone?

The Court of Justice of the EU answered it on September 4, 2025, in the SRB ruling (case C-413/23 P).

The case: an EU body had sent comments to a consulting firm, with the authors replaced by codes.

The EU body kept the table linking codes to authors.

The consulting firm had no access to it.

The Court drew three lessons:

1. For whoever keeps the link, the data is still personal data.
   They can identify people, so the GDPR fully applies.
2. For the recipient, it depends on their means.
   If they have no reasonable means of identifying people, the data may not be personal data for them.
3. The duty to inform does not change.
   It is assessed at the time of collection, from the collecting organization’s point of view: people had to be told their data would be shared.

The EDPB follows this reading in its 2026 anonymization guidelines.

But the ruling is not a free pass: in 2026, IQVIA relied on it before France’s CNIL and lost, as its health data was found to be only pseudonymized (see the IQVIA fines).

In practice, before sharing pseudonymized data, ask what the recipient could do with it:

1. Do they have access to the link table?
   Directly, or through a connection with whoever holds it.
2. Do they have other sources?
   A customer database, a directory, public data that would allow cross-checking.
3. Are identities left in the free text?
   One name in a comment or a report is enough to undo the pseudonymization of the columns.

If the answer to any of these is yes, the data is still personal data for them.

When to pseudonymize

Pseudonymize when you need to follow the same person through the data.

1. Analysis over time.
   Following a customer’s or a patient’s journey without seeing their name.
2. Test environments.
   Keeping data consistent from one table to another: the same customer has the same identifier everywhere, as explained in our guide to test data masking.
3. Documents that must stay readable.
   A realistic pseudonym lets people read a file normally.

When to anonymize

Anonymize when the link to the person is no longer needed.

1. Sharing outside the organization.
   A document sent to a vendor, an expert or a partner.
2. Publication.
   A decision, a report, statistics.
3. Long-term retention.
   Anonymized data can be kept for studies, outside the GDPR.

For PDFs, anonymization means redaction: see how to redact a PDF.

How to pseudonymize data

1. Detect the data that identifies a person.
   Names, addresses, phone numbers, emails, bank account numbers, Social Security numbers, in columns as well as in free text.
2. Choose the method, data type by data type.
   A realistic pseudonym for names, a constant identifier for customer numbers, for example.
3. Replace each value consistently.
   The same person must get the same pseudonym in every file and every table.
4. Document the processing.
   What was detected, and what was replaced.

The hardest step is the first one: a single missed value can be enough to identify someone.

To prepare it, see our guide to PII redaction.

With NymData

NymData offers both approaches, on your own servers.

1. Anonymization.
   Each detected value is replaced by its type, such as [PERSON] or [IBAN], and PDFs are redacted with opaque black boxes.
2. Realistic pseudonymization.
   Names are replaced by other plausible names.
3. Constant identifier.
   The same person gets the same identifier across the whole project: Word, Excel, CSV files and databases.
4. Custom.
   A different method for each data type.

Each run produces an audit report: what was detected, and what was done.

See how NymData works