WhatsApp and Telegram +44 7563 115980
[email protected]
Three terms that are often used as if they meant the same thing. In law they have different tests and very different effects. This guide sets out each one under UK GDPR, EU GDPR and US law, with worked examples.
Since 2013 we have helped firms with due diligence and data services, in more than 60 countries.
The short answer
Anonymisation removes the link between data and a person so that no one can be identified by any means reasonably likely to be used. Anonymous data is outside UK and EU data protection law. Pseudonymisation replaces names and other identifiers with codes, but the person can still be identified using extra information kept separately, so pseudonymised data remains personal data. De-identification is the general term for removing identifying details; whether the result is anonymous or pseudonymised depends on how well it is done and who holds it. In the US, de-identification has specific legal tests under California law and under HIPAA for health data.
On this page
| Term | What it means | Legal effect |
|---|---|---|
| Anonymisation (UK and EU) | The person is not, or is no longer, identifiable by any means reasonably likely to be used (GDPR Recital 26) | Data protection law does not apply to the anonymous result, though the process of anonymising is itself regulated |
| Pseudonymisation (UK and EU) | Data can no longer be linked to a specific person without additional information, which is kept separately and protected (GDPR Article 4(5)) | Still personal data; the law applies in full. It reduces risk and supports compliance |
| De-identification (UK) | Data processed so that it can no longer be attributed, without more, to a specific person (Data Protection Act 2018, section 171) | Re-identifying it without the consent of the organisation that de-identified it is a criminal offence |
| Deidentified (California) | Cannot reasonably be linked to a consumer, with reasonable measures, a public commitment not to re-identify and contracts binding recipients | Not personal information under the California Consumer Privacy Act |
| De-identified (US health data) | Either 18 listed identifiers removed with no actual knowledge of identifiability, or an expert finds the risk very small (HIPAA) | No longer protected health information under the HIPAA Privacy Rule |
UK GDPR does not define anonymous information directly. Recital 26 describes it as information which does not relate to an identified or identifiable person, or personal data rendered anonymous so that the person is no longer identifiable. To decide whether someone is identifiable, account is taken of all the means reasonably likely to be used, by the organisation or by another person.
The ICO (Information Commissioner's Office, the UK regulator) describes identifiability as a spectrum. At one end information clearly relates to a person; at the other it clearly does not; in between is a band that needs careful judgement. Anonymisation succeeds when the risk of identification is sufficiently remote. Purely hypothetical risks can be ignored.
The ICO recommends the motivated intruder test as a starting point: could a reasonably competent person, with no special skills, identify someone using the internet, public records and ordinary investigative methods? Its two key indicators are singling out (isolating one person's records) and linkability (combining the data with other information to identify someone). The ICO cites the 2006 Netflix Prize dataset, where researchers identified users' viewing records by comparing them with public reviews on another website.
One point is often missed: applying anonymisation to personal data counts as processing. The organisation needs a lawful basis and must be transparent about it, even though the anonymous result falls outside the law.
Article 4(5) of UK GDPR defines pseudonymisation as processing personal data so that it can no longer be attributed to a specific person without additional information, provided that information is kept separately and protected. The ICO lists hashing (turning a value into a fixed-length code), encryption and tokenisation (replacing a value with a random substitute) as the most common techniques.
Recital 26 states that pseudonymised data which could be attributed to a person by using additional information should be considered information about an identifiable person. In the hands of an organisation that holds the key, it is personal data. The ICO adds that if pseudonymised data is shared without the additional information, it may be anonymous in the recipient's hands, depending on what that recipient could reasonably do.
Pseudonymisation is valuable because it reduces risk, supports security and helps with reuse of data for new purposes. It does not, on its own, take data outside the law.
We de-identify datasets on your own systems, test them against the legal standard and document the result for buyers and regulators.
Speak to an expertData de-identificationOn 4 September 2025 the Court of Justice of the European Union ruled in EDPS v SRB (Case C-413/23 P). The Single Resolution Board had passed pseudonymised comments to an outside adviser. The Court confirmed that pseudonymised data must not be regarded as personal data in all cases and for every person: pseudonymisation may, depending on the circumstances, prevent anyone other than the original organisation from identifying the person, so that for them the person is not identifiable. The original organisation's duties continue.
The European Data Protection Board (EDPB, the body of EU data protection regulators) published Guidelines 01/2025 on pseudonymisation for consultation in January 2025. On 8 July 2026 it published Guidelines 02/2026 on anonymisation for consultation. These set three criteria to test whether data is anonymous: no record isolation (no unique combination of values pointing to one person), no linkage (no record can be matched to the same person in another dataset) and no inference (no specific and meaningful conclusion about a person can be drawn). If all three are met, the data can be considered anonymous; if not, further analysis is needed.
For AI, the EDPB's Opinion 28/2024 adds that a model trained on personal data cannot in all cases be considered anonymous. Anonymity requires that the chance of extracting personal data from the model, or obtaining it through queries, is insignificant.
US law has no single definition. The two most important for data deals are California's and the federal health privacy rule.
Take a customer support record: Jane Smith, [email protected], account 448812, born 14 March 1984, Leeds, called about a late refund and mentioned her recent surgery.
| Version | What changed | Status |
|---|---|---|
| Original | Nothing | Personal data, including health information, which is special category data |
| Pseudonymised | Name, email and account replaced with a code; the company keeps the key | Still personal data for the company. The health detail is still present |
| Pseudonymised and shared without the key | As above, but the recipient never receives the key | May be anonymous for the recipient, depending on what else it holds or could obtain. Still personal data for the company |
| Anonymised | Codes have no key; date of birth becomes a decade; Leeds becomes a region; the health detail is removed; the text is checked for other clues | Anonymous if the motivated intruder test is passed and no record can be isolated, linked or inferred |
| Aggregated | Only counts remain, such as the number of refund calls per region per month | Anonymous, provided small counts cannot point to individuals |
Owners preparing data for sale can read how this fits into a deal in our guide on how to sell data to AI companies, and see how we carry out the work on our data de-identification page. Buyers can see the standard we apply on our AI training data page.
Anonymisation removes the link to a person so no one can be identified by means reasonably likely to be used. Pseudonymisation replaces identifiers with codes, but the person can be re-identified with information kept separately, so the data remains personal data.
Yes, for any organisation that holds or can obtain the additional information. Under the 2025 SRB judgment and ICO guidance, it may be anonymous for a recipient who cannot reasonably re-identify anyone.
No. Truly anonymous data is outside UK and EU data protection law. The test is whether anyone can be identified by any means reasonably likely to be used, so weak anonymisation leaves data personal.
Not necessarily. De-identification is the general process of removing identifying details. The result may be anonymous or only pseudonymised, depending on the methods used and who holds the data.
The ICO's starting point for assessing identifiability: whether a reasonably competent person, without special skills, could identify someone using the internet, public records and ordinary investigative methods.
No, but it applies to the process of anonymising personal data. The organisation needs a lawful basis and must be transparent about the processing.
No. The ICO lists hashing as a pseudonymisation technique and warns that weak hashing is open to brute force and dictionary attacks, which match hashed values back to known ones.
It can. The EDPB's Opinion 28/2024 says models trained on personal data cannot in all cases be considered anonymous, and anonymity must be shown case by case.
Each point of law and each reported figure on this page was checked against these sources on 27 October 2026. This page is general information, not legal advice.
Tell us about the data you hold and who you want to share it with.