A research agency delivers a dataset to a client, describing it as anonymised. The names are out, replaced by respondent numbers. The key sits in a separate file on a different server, as it should.
That dataset is not anonymised. It is pseudonymised, which means every GDPR obligation still applies.
No privacy terms get misused more than these, and the consequence is always the same: somebody believes the job is done.
#The three operations
Anonymising. The data has been altered so that nobody can identify the person any more, not even with additional information or by combining it with other sources. If that is genuinely the case, it is no longer personal data and the dataset falls outside the GDPR.
Pseudonymising. Identifying values are replaced by a code or key. The person is not directly identifiable but can be identified with the key. It remains personal data. The GDPR names it explicitly as a security measure, not as an exit route.
Masking. A value is hidden when it is displayed, for example showing only the last four digits of an account number. The underlying data usually sits unchanged in the system. This is an access control: it governs who sees what, not what is stored.
#Why only the first removes obligations
The GDPR governs personal data. Where data can no longer be attributed to a person, the regulation does not apply and the whole set of obligations falls away: legal basis, purpose limitation, retention, data subject rights, breach notification.
Pseudonymisation removes none of that. The data is better protected, which counts towards whether you have implemented appropriate measures. You still need a legal basis, and a data subject can still request access or erasure.
Masking removes nothing at all, because nothing about the stored data has changed.
#The bar for anonymity is high
This is where it goes wrong in practice, even among people who know the difference.
The question is not whether you can identify the person. The question is whether identification is reasonably possible, by anyone, using the means and data available.
That is stricter than it sounds, because combining data reveals so much. A dataset without names but with postcode, date of birth and gender already identifies most people. Add job title and organisation, and in a team of twelve only one person fits. See why removing names is not enough.
Anonymity is therefore not a property of an operation but an outcome you assess per dataset and per context. The same transformation can produce anonymity in a national sample and fail in a department of twelve.
The same question arises with AI models. In their opinion on AI models the European data protection authorities concluded that a model trained on personal data cannot simply be treated as anonymous, and that the assessment must be made case by case.
#What to choose in practice
Purpose determines the operation.
Publishing data or taking it outside the GDPR? It has to be anonymisation, backed by a reasoned explanation of why re-identification is not reasonably possible. Aggregation, generalisation and thresholds are the usual techniques.
Research where you must re-link later? Pseudonymisation is the right choice, with the key kept separately and only a small group able to access it. And call it that.
Preventing staff from seeing more than they need? Masking is exactly the right tool, and it is not a processing measure.
Putting something into an AI tool? The legal classification matters less than the practical question of which data the task requires. It is usually a combination: remove what is not needed, replace what is needed as context, mask what must keep its structure. See the prompt redaction guide.
#The word you use is not neutral
"We anonymise the data" is a commitment. Written into a data processing agreement, a privacy notice or a DPIA, it becomes something you can be held to. If it turns out to have been pseudonymisation, the word was wrong, and so was the conclusion attached to it: that the GDPR no longer applied.
So it pays to use the precise word, even when it sounds weaker. Pseudonymisation that is described correctly puts you in a stronger position than anonymisation that does not survive scrutiny.
