Anonymization vs pseudonymization — the differences under GDPR

Anonymization irreversibly removes the ability to link data to a specific person — anonymized data is no longer personal data, and the GDPR no longer applies to it. Pseudonymization is a reversible replacement of identifiers, and pseudonymized data remains personal data fully subject to the GDPR. That is the single most important difference — and the most common source of costly misunderstandings in companies that process customer data.

Definitions: what the GDPR says

Anonymization — transforming personal data so that the data subject can no longer be identified, directly or indirectly, by any means reasonably likely to be used. The GDPR does not define anonymization explicitly — it is addressed in Recital 26, which states that data protection principles do not apply to anonymous information.

Pseudonymization — under Article 4(5) GDPR, the processing of personal data in such a way that it can no longer be attributed to a specific person without the use of additional information, provided that the additional information (e.g. a key or mapping table) is kept separately and protected by technical and organisational measures.

The key test from Recital 26: to decide whether a person is identifiable, you must consider all means reasonably likely to be used for identification — including cost, time, and available technology. If re-identification is realistically possible, the data is not anonymous.

Comparison: anonymization vs pseudonymization

Criterion	Anonymization	Pseudonymization
Reversibility	Irreversible	Reversible (with a key / additional data)
Data status	No longer personal data	Still personal data
Does GDPR apply?	No (Recital 26)	Yes, in full
Basis in GDPR	Recital 26	Art. 4(5), Art. 25, Art. 32
Obligations (records, breach notification, data subject rights)	Do not apply to anonymous data	Still apply
Typical use	Publishing data, statistics, AI training, external sharing	Internal analytics, testing, risk reduction
Example	”Jan Kowalski” → “[PERSON]” with no way back	”Jan Kowalski” → “ID-8241” + a separate mapping table

Practical examples: national ID (PESEL), tax ID (NIP), email address

PESEL (Polish national identification number). A PESEL uniquely identifies a person and additionally reveals their date of birth and sex.

• Pseudonymization: 85010212345 → CUSTOMER-0042, with the lookup table stored in a separate, secured system. Still personal data.
• Anonymization: the number is permanently removed or replaced with a [PESEL] placeholder, with no mapping table. If the rest of the record does not allow identification either, the data falls outside the GDPR.

NIP (Polish tax identification number). A sole trader’s NIP is personal data (a company’s NIP generally is not, since it relates to a legal person). Replacing NIP 521-30-51-000 with [NIP] in a document sent to an external advisor removes the identifier — but you still need to check whether the context (company name, address) points to a specific individual.

Email address. The address [email protected] identifies a person directly — it contains a first name, surname, and workplace.

• Pseudonymization: [email protected] with a retained key.
• Anonymization: [EMAIL] — provided the identity cannot be reconstructed from the remaining fields or from external sources.

That last caveat matters: anonymizing a single field does not anonymize the record. The combination of a postcode, date of birth, and job title can single out one specific person even though none of those fields looks like an identifier on its own.

When pseudonymization is enough — and when you need anonymization

Pseudonymization is enough when:

• the data stays inside your organisation and you need to be able to re-identify people (customer support, billing, research with follow-up),
• the goal is risk reduction and data minimisation — the GDPR explicitly lists pseudonymization as a data-protection-by-design measure (Art. 25) and a security measure (Art. 32),
• test and development environments must preserve the structure of production data.

Anonymization is required when:

• the data should leave the GDPR regime entirely: publication, sharing with partners, open datasets,
• you want to keep data beyond its retention period (anonymous data is not subject to erasure obligations),
• content is going into an external AI tool (ChatGPT, Claude, Gemini) and you have no data processing agreement covering that purpose — removing personal data before pasting is the simplest route to compliance.

That last scenario is exactly what Amaze handles: it detects and masks personal data (including Polish identifiers like PESEL, NIP, REGON, and Polish names across grammatical cases) locally, on your own machine, before any text reaches an AI model.

Common mistakes

1. “We hashed the ID number, so the data is anonymous.” No. Hashing is deterministic — the same number always produces the same hash, and the space of national ID numbers is small enough to brute-force. At best, that is pseudonymization.
2. Removing only the name. The remaining fields (address, job title, a rare medical condition, a case number) often still identify the person indirectly.
3. Storing the mapping key next to the data. Pseudonymization requires the additional information to be kept separately and protected — otherwise it does not meet the Article 4(5) definition.
4. Treating pseudonymization as a GDPR exemption. Pseudonymized data is still personal data: records of processing, breach notification, and data subject rights all continue to apply.

FAQ

Does the GDPR apply to anonymized data? No. Under Recital 26, data protection principles do not apply to anonymous information — information that does not relate to an identified or identifiable person.

Does pseudonymization exempt you from GDPR obligations? No. Pseudonymized data remains personal data. Pseudonymization is a recommended safeguard (Art. 25 and Art. 32 GDPR) that reduces risk, but it does not switch the regulation off.

Is replacing an ID number with a random identifier anonymization? Only if no key or method exists to reconstruct the number, and the remaining data in the record cannot identify the person. If a mapping exists anywhere, it is pseudonymization.

Can I paste client data into ChatGPT after pseudonymizing it? Pseudonymized data is still personal data, so passing it to an AI provider requires a legal basis and GDPR compliance. The safer approach is to anonymize the content before sending it — ideally locally, before the data ever leaves your device.

Part of our complete guide to data anonymization.