A research agency delivers a dataset to a client, describing it as anonymised. The names are out, replaced by respondent numbers. The key sits in a separate file on a different server, as it should.
That dataset is not anonymised. It is pseudonymised, which means every GDPR obligation still applies.
This distinction gets misused more than any other privacy term, and the consequence is always the same: somebody believes they are finished.
#The three operations
Anonymising. The data has been altered such that nobody can identify the person any more, including with additional information and including by combining with other sources. Where that genuinely holds, it is no longer personal data and the dataset falls outside the GDPR.
Pseudonymising. Identifying values are replaced by a code or key. The person is not directly visible and remains recoverable with the key. It stays personal data. The GDPR names it explicitly as a security measure, not as an exit route.
Masking. A value is hidden in the display, for example showing only the last four digits of an account number. The underlying data usually sits unchanged in the system. This is an access control: it governs who sees what, not what is stored.
#Why only the first removes obligations
The GDPR governs personal data. Where data can no longer be attributed to a person, the regulation does not apply and the whole set of obligations falls away: legal basis, purpose limitation, retention, data subject rights, breach notification.
Pseudonymisation removes none of that. The data is better protected, which counts toward whether you have implemented appropriate measures. You still need a legal basis, and a data subject can still request access or erasure.
Masking removes nothing at all, because nothing about the stored data changed.
#The bar for anonymity is high
This is where it goes wrong in practice, including among people who know the distinction.
The question is not whether you can identify the person. The question is whether identification is reasonably possible, by anyone, using the means and data available.
Stricter than it sounds, because combination yields so much. A dataset without names but with postcode, date of birth and gender already identifies most people. Add job title and organisation and in a team of twelve there is one candidate. See why removing names is not enough.
Anonymity is therefore not a property of an operation but an outcome you assess per dataset and per context. The same transformation can yield anonymity on a national sample and fail on a department of twelve.
The same question arises with AI models. In their opinion on AI models the European data protection authorities concluded that a model trained on personal data cannot simply be treated as anonymous, and that the assessment must be made case by case.
#What to choose in practice
Purpose determines the operation.
Publishing data or taking it outside the GDPR? It has to be anonymisation, accompanied by a justification of why re-identification is not reasonably possible. Aggregation, generalisation and thresholds are the usual techniques.
Research where you must re-link later? Pseudonymisation is right, with the key managed separately and a limited circle able to reach it. Then call it that.
Preventing staff from seeing more than they need? Masking is exactly the right tool, and it is not a processing measure.
Putting something into an AI tool? The legal classification matters less than the practical question of which data the task requires. Usually a combination: remove what is superfluous, replace what is needed as context, mask what must keep its structure. See the prompt redaction guide.
#The word you use is not neutral
One closing point that goes beyond terminology.
"We anonymise the data" is a commitment. Written into a processing agreement, a privacy notice or a DPIA, it becomes testable. If it turns out to have been pseudonymisation, it is not only the word that was wrong but the conclusion attached to it: that the GDPR no longer applied.
So it pays to use the precise word, even when it sounds weaker. A correctly described pseudonymisation is a stronger position than an anonymisation that does not survive scrutiny.
