Does GDPR still apply to anonymized data? Erasure, retention & Recital 26
5 min read
No — the GDPR does not apply to data that has been truly anonymized. Recital 26 states that the principles of data protection do not apply to anonymous information that does not relate to an identified or identifiable person. The catch is the word truly: anonymization only escapes the GDPR if re-identification is no longer reasonably possible by any party, using any means reasonably likely to be used. Fall short of that and you still hold personal data with every obligation attached.
TL;DR
- Truly anonymized data is out of scope of the GDPR (Recital 26). You can keep and reuse it freely.
- The standard is irreversibility — judged against all means reasonably likely to be used to re-identify, by you or anyone else.
- Pseudonymized data is still personal data (Art. 4(5)) and stays fully in scope, because a key can reverse it.
- Genuine anonymization satisfies the right to erasure (Art. 17) — you can “delete” a person by anonymizing the record, if it’s really irreversible.
- Anonymization is also the clean answer to storage-limitation limits (Art. 5(1)(e)): anonymize instead of retaining identifiable data past its purpose.
Does the GDPR apply to anonymized data?
No. Recital 26 is explicit: “The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
Once data is anonymous, it is no longer personal data as defined in Art. 4(1), and the GDPR simply does not reach it. You can store it indefinitely, analyse it, share it, and use it to train models without a legal basis, consent, or retention limit.
The whole question, then, collapses into one word: is the data actually anonymous?
When is data “truly” anonymized?
Recital 26 sets the test. To decide whether a person is identifiable, you must account for “all the means reasonably likely to be used, such as singling out, either by the controller or by another person, to identify the natural person directly or indirectly.”
Three things follow:
- It’s not about your intent — it’s about capability. If re-identification is reasonably possible for anyone, the data is not anonymous.
- You must consider combinations. Removing a name is not enough if a birth date plus a postcode plus a job title still single out one person. (See re-identification risk.)
- Reversible techniques don’t qualify. If a key, lookup table, or algorithm can restore the original, it’s pseudonymization, not anonymization.
The EU guidance behind this is WP29 Opinion 05/2014 on Anonymisation Techniques, which stresses three risks any method must defeat: singling out, linkability, and inference.
Anonymization vs pseudonymization — the line that decides scope
| Anonymization | Pseudonymization | |
|---|---|---|
| Reversible? | No — irreversible | Yes — with a separate key |
| GDPR status | Out of scope (Recital 26) | Personal data, in scope (Art. 4(5)) |
| Right to erasure | Satisfied | Not satisfied by itself |
| Retention limit | None | Storage limitation still applies |
| Example | Jan Kowalski → [PERSON], mapping destroyed | Jan Kowalski → USER_8842, mapping kept |
The distinction is entirely about whether a link back to the individual survives. See anonymization vs pseudonymization for the full breakdown.
Does the right to erasure (Art. 17) require deletion — or is anonymizing enough?
Anonymizing a record is a recognised way to honour an erasure request. Once the data no longer identifies the person, the person’s data has, in effect, been erased — there is nothing left to which their rights attach.
Two conditions:
- The anonymization must be genuine and irreversible — no retained key, no re-identifiable quasi-identifier combination.
- You must anonymize every copy, including backups and downstream datasets, or the identifiable version still exists somewhere.
This makes anonymization a practical retention tool: rather than deleting analytically valuable records outright, you strip them of identity and keep the aggregate value — without breaching Art. 5(1)(e) storage limitation.
A practical before/after
Say you must retain purchase history for analytics but no longer have a lawful basis to keep it identifiable:
Before (personal data, in scope):
Jan Kowalski, 85010212345, [email protected], Kraków, bought X on 2026-03-01
After (anonymized, out of scope):
[PERSON], [PESEL], [EMAIL], [CITY], bought X on 2026-03If the mapping from Jan Kowalski to [PERSON] is destroyed and the remaining fields can’t single him out, the record is outside the GDPR — and you can keep it for as long as it’s useful.
FAQ
Is anonymized data personal data? No. Truly anonymized data does not relate to an identified or identifiable person, so it falls outside the Art. 4(1) definition of personal data and outside the GDPR (Recital 26).
Is pseudonymized data outside the GDPR? No. Pseudonymized data is explicitly personal data under Art. 4(5) because the pseudonymization can be reversed with the separate key. It stays fully in scope.
Can I keep anonymized data forever? Yes. Storage-limitation rules (Art. 5(1)(e)) apply only to personal data. Once data is genuinely anonymous, there is no retention limit.
Does anonymizing a record satisfy a right-to-erasure request? It can, if the anonymization is irreversible and applied to every copy. The individual is then no longer identifiable, which achieves the aim of Art. 17.
Is hashing or encryption anonymization? No. Encryption is reversible with the key; hashing of a small, guessable value (like a national ID) can be brute-forced. Both are pseudonymization at best.
Amaze anonymizes personal data — names (including Polish inflected forms), PESEL, NIP, REGON, KRS, emails, phones, IBANs and more — entirely on your own machine. Mask irreversibly to take data out of scope, or keep a private key when you need reversibility. See how it works.
Part of our complete guide to data anonymization.