Anonymization under RODO: UODO requirements and how to do it correctly
5 min read
Under RODO — the Polish application of the GDPR — anonymization means transforming personal data irreversibly so the person can no longer be identified by any means reasonably likely to be used; at that point, under Recital 26, the data leaves the scope of the regulation. Poland’s data-protection authority, UODO (Urząd Ochrony Danych Osobowych), consistently stresses that anonymization is not pseudonymization: what counts is genuine, permanent irreversibility, assessed with the possibility of data linkage in mind. This guide covers when anonymization is effective under RODO and how to treat Polish national identifiers.
TL;DR
- Anonymization = irreversibility. Only when re-identification is no longer reasonably possible does data stop being personal data (RODO Recital 26).
- Pseudonymization is not anonymization. Pseudonymized data stays personal data (Art. 4(5)) and remains fully subject to RODO.
- Assessing identifiability must account for singling out, linkability and inference — deleting the name is not enough.
- Polish identifiers (PESEL, NIP, REGON, KRS) are unusually information-rich — a PESEL alone encodes date of birth and sex, so masking it matters.
- UODO expects accountability (Art. 5(2)): document your anonymization method and your re-identification-risk assessment.
What RODO and UODO mean by anonymization
The GDPR does not define “anonymization” in an article, but Recital 26 sets the threshold: the principles of data protection do not apply to “personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.” To judge identifiability you weigh “all the means reasonably likely to be used” by the controller or any other person.
In practice UODO and the earlier EU guidance (WP29 Opinion 05/2014) reduce effective anonymization to defeating three risks:
- Singling out — can you isolate one person’s record?
- Linkability — can you link the same person’s records across datasets?
- Inference — can you deduce a missing value from what remains?
If any of these stays realistic, the data is still personal data.
Anonymization vs pseudonymization — the distinction UODO draws
| Anonymization | Pseudonymization | |
|---|---|---|
| Reversible? | No — permanently irreversible | Yes — with a separate key |
| RODO status | Outside RODO (Recital 26) | Personal data (Art. 4(5)) |
| Controller obligations | End for that data | Full RODO obligations |
| Example | Jan Kowalski → [PERSON], mapping destroyed | Jan Kowalski → USER_8842, key kept |
This distinction has real consequences: companies often claim “anonymization” while quietly keeping a mapping key — which is pseudonymization, with all RODO obligations intact. See anonymization vs pseudonymization for the full breakdown.
Polish identifiers: PESEL, NIP, REGON, KRS
Polish identification numbers are exceptionally information-rich, so they need special care:
- PESEL — 11 digits encoding date of birth and sex. Even with the name removed, a PESEL alone can narrow identity to one person.
- NIP — the tax identification number; ties a record to a specific taxpayer (person or company).
- REGON — the statistical number of a business entity.
- KRS — the National Court Register number, uniquely identifying a registered entity.
Correct anonymization must detect and mask these as whole tokens, because partial redaction (e.g. leaving part of a PESEL) can still enable singling out:
Before:
Jan Kowalski, PESEL 85010212345, NIP 1234567890, tel. +48 601 234 567
After (correct anonymization):
[PERSON], PESEL [PESEL], NIP [NIP], tel. [PHONE]An extra difficulty in Polish: name inflection. “Kowalski”, “Kowalskiego”, “Kowalskiemu” are the same person — the tool must recognise every grammatical form, or some occurrences leak through.
Checklist for correct, RODO-compliant anonymization
- Inventory the personal data — including indirect identifiers (quasi-identifiers): postcode, birth date, job title.
- Detect the Polish identifiers — PESEL, NIP, REGON, KRS, and names in every grammatical form.
- Mask completely and consistently — whole tokens, the same value always the same way (either irreversibly, or with a key if you need reversibility).
- Check combinations — make sure the remaining fields don’t single out the person (see re-identification risk).
- Destroy the mapping if the goal is full, irreversible anonymization (and thus leaving RODO scope).
- Document the method and the re-identification-risk assessment — accountability under Art. 5(2).
FAQ
Does anonymization under RODO require the person’s consent? The act of anonymizing is itself processing of personal data, but once the output is fully anonymous, further use of it is outside RODO. You still need to assess a lawful basis for the anonymization process itself.
Is masking the PESEL enough to make data anonymous? Not always. You must also check whether the combination of remaining fields (e.g. town + date + occupation) still points to one person.
Does UODO mandate a specific anonymization technique? UODO does not prescribe one technique; it expects effectiveness (irreversibility) and accountability — documenting the method and the risk assessment.
Is encrypting data anonymization? No. Encryption is reversible with the key, so it is pseudonymization — the data remains personal.
Is a company’s data personal data? Generally no, but data about natural persons connected to the company (e.g. a sole trader, their NIP/PESEL) is.
Amaze detects and masks Polish identifiers — PESEL, NIP, REGON, KRS — and names across every grammatical case, entirely locally on your own machine. Mask irreversibly in line with Recital 26, or keep a private key when you need reversibility, plus an audit report for your DPO. See how it works.
Part of our complete guide to data anonymization.