Pseudonymisation swaps identifiers for codes that can be reversed with a key; anonymisation removes the link to a person for good. The legal difference is large. Pseudonymised data is still personal data under GDPR (Art. 4(5), Recital 26), so every rule still applies. Anonymised data is not personal data at all, so GDPR stops applying and the data can be reused, shared or sold freely.
An everyday example
A dermatology clinic, "Hautpraxis Weber", wants to share treatment data with a research partner.
- Pseudonymised version: "Anna Schmidt, born 3 March 1981" becomes "Patient 4471". The clinic keeps a separate table linking 4471 back to Anna. The research partner sees diagnosis, medication, age band and postcode, but not her name.
- Anonymised version: there is no linking table anywhere, and the remaining details are stripped or coarsened so far that nobody, using means reasonably likely to be used, could work out that the record is Anna's.
The first is still Anna's personal data. The second, if it is truly anonymous, legally is not anybody's data.
The details, simply
What pseudonymisation means
GDPR Art. 4(5) defines pseudonymisation as processing personal data so it can no longer be attributed to a specific person without additional information, provided that information is kept separately and protected. Common techniques:
- Replacing names with random codes or patient numbers.
- Hashing email addresses or ID numbers.
- Tokenising account numbers.
GDPR encourages pseudonymisation as a security measure. But it is a safeguard, not an exit: the data stays personal data, needs a legal basis, and data subjects keep their rights. In 2025 the EU Court of Justice added one nuance (EDPS v SRB, C-413/23 P): a recipient who has no reasonable means of re-identifying people may not be holding personal data. For whoever holds the key, it always is.
What anonymisation means
Recital 26 says data protection does not apply to anonymous information: data that does not relate to an identified or identifiable person. To decide whether someone is identifiable, you look at all the means reasonably likely to be used, considering cost, time and available technology. That test moves over time. What was anonymous in 2015 may not be anonymous against today's AI and today's public datasets.
The quick comparison
| Pseudonymised | Anonymised | |
|---|---|---|
| Can be linked back to a person? | Yes, with the key or extra data | No, by any reasonably likely means |
| Personal data under GDPR? | Yes | No |
| Needs a legal basis? | Yes | No |
| Can be shared or sold free of GDPR rules? | No | Yes |
Re-identification: why "anonymous" often is not
Removing names is easy. Making data truly anonymous is hard, because the remaining details act like a fingerprint.
- ZIP code, birth date and sex. Researcher Latanya Sweeney showed that about 87% of Americans can be uniquely identified from just these three facts.
- 15 attributes. A 2019 study in Nature Communications found that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes.
- Netflix Prize. Netflix released "anonymised" movie ratings for a competition. Researchers matched them to public reviews and re-identified users.
- AOL search logs. AOL published search queries with user numbers instead of names. Journalists identified individual users from what they had searched for.
AI makes this cheaper. Matching scattered details, an age, a postcode, a lab value, a time, against public records and other datasets used to take an analyst days. Now it can run at scale.
Regulators are paying attention
In 2026, France's data protection authority, the CNIL, fined a health-data company €5 million over its health data warehouses. The company argued that its prescription data was anonymous; the CNIL found it was only pseudonymised. The data had no names, but it could still be linked back to people by reasonable means, so GDPR applied the whole time.
This is general information, not legal advice.
What it does not protect
Here is the uncomfortable part. Data protection law, and professional confidentiality behind it, is built around the identifiable person. Remove the identity convincingly enough and the law lets go.
- Once data counts as anonymous, it is outside GDPR. It can be pooled, licensed and sold, legally.
- What stays in the record is usually what has value: the diagnosis, the dosage, the contract clause, the deal size.
- Many terms of service give providers a licence to use your content to create "aggregated" or "de-identified" data. Once that licence exists, the step to anonymise and reuse is lawful.
- And if the anonymisation is weak, the data can come back to a person through re-identification, after it has already left your control.
We trace that path visually on our data trail page and set out the legal mechanism, with sources, on legal to sell. The industry that buys these datasets is explained in what is a data broker.
What this means when you use AI tools
When you choose an AI tool for client or patient work, ask:
- Does the provider's licence include creating anonymised, aggregated or de-identified data from my content? If yes, your content can leave the protection of GDPR.
- Is "anonymised" defined, and by whose standard? A promise that data is "anonymised before use" may in practice mean pseudonymised.
- Is my content ever used for training? Training is a form of reuse.
- What is retained, and for how long? Data that is deleted cannot be anonymised later.
Wysor is built so the question never arises. We take no licence to reuse your content; we process it only to run the service for you, as your processor under Art. 28 GDPR. We never train on it and never sell it, anonymised or not. Those commitments are in the contract and bind anyone who could ever own Wysor. Data is encrypted in transit and at rest, hosted in the EU, and every connected AI model provider runs with zero data retention: processed, then deleted.
FAQ
What is the difference between pseudonymisation and anonymisation? Pseudonymisation replaces identifiers with codes that can be reversed with separately stored information, so the data is still personal data. Anonymisation removes any reasonably likely way to identify the person, so GDPR no longer applies.
Is pseudonymised data personal data? Yes. GDPR Art. 4(5) and Recital 26 treat pseudonymised data as personal data, because it can be attributed to a person with additional information.
What does data anonymisation mean? It means processing data so that it no longer relates to an identified or identifiable person, taking into account all means reasonably likely to be used to re-identify them. Truly anonymised data falls outside GDPR.
Can anonymised data be re-identified? Often, yes. Studies show that a handful of attributes such as postcode, birth date and sex identify most people, and famous datasets like the Netflix Prize ratings and AOL search logs were re-identified after release.
Is hashing an email address anonymisation? No. A hash of the same email address always produces the same value, so it can be matched across datasets. It is a pseudonymisation technique, and the data stays personal data.
Further reading
- What is GDPR? A simple explanation
- What is special category data? GDPR Article 9 explained
- What is a data broker?
- GDPR fines: how much, for what, and how they are calculated
- Legal to sell: how anonymised data becomes an asset
Questions about using AI with sensitive data? Reach us at [email protected] or through the in-app contact form.
