Anonymisation and pseudonymisation: avoiding re-identification

Anonymised data falls outside the GDPR once a natural person can no longer be identified by means reasonably likely to be used. Pseudonymised data remains personal data where attribution is possible with additional information. The name given to a method therefore does not decide whether the data is personal.

This article distinguishes the two concepts for businesses. It explains whose perspective matters, how the three EDPB criteria No Record Isolation, No Linkage and No Inference can be applied, and which evidence should exist before data is used or disclosed. A technical measure alone does not replace a legal and practical assessment.

Under Article 4(1) GDPR, personal data is information relating to an identified or identifiable natural person. Recital 26 assesses identifiability by reference to means reasonably likely to be used, considering objective factors. This can include means that another party could use or make available.

Article 4(5) GDPR describes pseudonymisation as processing that prevents attribution to a specific person without additional information. The additional information must be kept separately and protected. The link to the person remains. Encryption, masking or replacing a name therefore does not automatically create anonymised data.

Data is anonymous only when the person is no longer identified or identifiable from the relevant perspective. The result depends on the content, purpose, recipient, access and comparison data available. A transformation can be anonymous for one recipient and personal data for another party.

The EDPB Guidelines 02/2026 on Anonymisation assess the issue from the perspective of each relevant entity. First identify for whom the data is intended to be anonymous. This may be the anonymising controller, a recipient or another party with access to the data.

Additional knowledge can come from internal files, public sources, a business partner, a service provider or a realistically accessible technical method. Removing names is therefore only one step. Combinations of age, place, time, behaviour or unusual events may still distinguish a person.

A reliable decision records objective factors: the properties and precision of the dataset, access conditions, possible additional information, the time and cost of identification and available technology. If a person has already been identified, the data is not anonymous from that perspective.

The EDPB Guidelines 02/2026 structure the technical assessment around three criteria. No Record Isolation asks whether individuals or records can be singled out. Rare attributes, high resolution or a unique combination can make this possible.

No Linkage asks whether information can be connected with other datasets or observations. Consider links within the dataset, public sources and other parties. No Inference asks whether further information about a person can be derived from the remaining values.

Doubt about one criterion does not automatically mean that the result is anonymous. The guidelines provide for further analysis in that situation. Businesses should simulate concrete attack or inference paths, identify the relevant perspective and keep the reasons for the final assessment.

A suitable transformation starts with the purpose. Aggregation can combine individual values into groups. Generalisation can replace precise values with broader categories. Deletion, masking or reduction can shrink the dataset. The necessary combination depends on the required analytical value and the remaining identification risk.

Pseudonymisation is often a safeguard for internal analysis, development or controlled cooperation. It can make direct attribution harder and is recognised as a measure under Articles 25 and 32 GDPR. It does not create a GDPR-free space. Keys, additional information, permissions and copies still need control.

Data quality affects the assessment in both directions. Inaccurate values may make direct identification harder, while many apparently harmless attributes can still single someone out in combination. Record the precision, permitted use and assumptions under which the method was considered sufficient.

Article 5(2) GDPR requires the controller to demonstrate compliance with the principles. Articles 24 and 25 connect that responsibility with suitable measures and reviews of effectiveness. The approval file should contain purpose, source data, method, recipients, perspective, tested linkages, residual risks and responsibility.

For pseudonymised data, the attribution keys must be protected separately. Roles, permissions, logging, disclosure, erasure and restoration must fit the actual risk. For anonymised data, security and governance questions from the original processing remain relevant while source data or other personal copies are retained.

Reassess when recipients, data volume, precision, public comparison data, technical capabilities or purpose change. The EDPB points to periodic reassessment of the likelihood of re-identification. A single approval is therefore not permanent evidence for every later use.

The name is removed and the dataset is released: Rare combinations, time values or external comparison data are not tested.

A key is called anonymisation: Attribution remains possible through additional information and the GDPR continues to apply.

Only the organisation’s own view is assessed: Recipients, providers or reachable parties may have other means.

Aggregation is treated as anonymity: Group values can still reveal information about individuals or permit inferences through combination.

The method is chosen without a purpose assessment: Broad categories may work for one analysis and fail for another.

The approval never changes: New sources, improved technology or a different recipient group can undermine the earlier assessment.

Start with a data and purpose description. What should remain possible, which people are involved and who gets access? Record source data, copies, keys and comparison sources. Separate the question whether a safeguard is useful from the question whether the link to a person has ended.

Then test the three EDPB criteria from every relevant perspective. Test rare records, realistic linkages and possible inferences. Record which means could reasonably be used and why identification risk is considered insignificant or remains relevant.

Before approval, method, access protection, recipients, responsibility and reassessment must be clear. With pseudonymisation, legal basis, purpose limitation, data-subject rights, security and erasure continue to apply. With anonymisation, check whether original personal data and the transformation are still processed separately.

We review source data, purpose, recipients, additional information, transformation method and the three EDPB criteria with you. A data matrix, planned data flow, keys or comparison sources, technical description and existing approval support the first assessment. This makes it possible to show whether a safeguard is sufficient or the data must still be treated as personal.