Under GDPR, pseudonymised data is still personal data because it can be linked back to a person using additional information. Anonymous data, where the person is no longer identifiable, falls outside the regulation. The difference is whether identification is reasonably likely, not what you call the dataset.
What each term means
Article 4(5) defines pseudonymisation as processing personal data so that it can no longer be attributed to a specific person without additional information, provided that information is kept separately and protected by technical and organisational measures.
Recital 26 states that pseudonymised data which could be attributed to a person by using additional information should be treated as information about an identifiable person. It also says the principles of data protection do not apply to anonymous information, or to personal data anonymised so that the person is not or no longer identifiable.
The identifiability test
Recital 26 tells you to consider all the means reasonably likely to be used to identify the person, by the controller or by anyone else, including singling out. To judge likelihood, consider objective factors such as cost, time, the technology available at the time and technological developments.
That makes anonymisation a judgment about risk, which can change. A dataset that was safe to publish five years ago may not be today if new data to link it with has appeared.
Common mistakes
Hashing an email and calling it anonymous. If anyone can hash a known email and compare, the value still points at a person. Treat it as pseudonymised.
Removing names only. Rare combinations of age, postcode and job can single someone out.
Forgetting the key. If the lookup table sits next to the dataset in the same store, you have not separated the additional information.
Assuming aggregation solves it. Small group sizes can still reveal individuals.
Where each is useful
- Pseudonymisation is named as a measure in Article 25 and Article 32. It lowers risk during analytics, testing and sharing between teams, while the regulation still applies in full.
- Anonymisation is used when you want to keep data for statistics or research after the personal purpose ends. If it truly is anonymous, retention limits and rights requests do not apply to it.
A working checklist
- Write down who could re-identify the data and with what.
- Separate any key or lookup table, restrict access to it and log use.
- Test re-identification by linking with data a motivated outsider could get.
- Re-test when you add fields, or when public data changes.
- Record the conclusion and who approved it.
If you cannot decide, treat the data as personal.
Quick check
Is tokenised data personal data?
If anyone can map the tokens back to people with reasonably available additional information, yes.
Can we keep anonymised data forever?
The regulation does not apply to truly anonymous information, but the claim must hold up under the identifiability test.
Sources
- GDPR Article 4, definitions
- GDPR Recital 26, not applicable to anonymous data
- GDPR Article 32, security of processing
- GDPR Article 25
Last reviewed: 19 October 2026.
