Difference between anonymizing and pseudonymizing under the GDPR

Anonymizing and pseudonymizing sound similar, but legally they are worlds apart. Confusing them is one of the most frequent causes of sanctions. This guide explains the difference between anonymizing and pseudonymizing and when to apply each technique.

GDPR definitions

• Anonymizing: irreversibly removing personal data so the individual can no longer be identified by any reasonable means. The document falls outside the GDPR (Recital 26).
• Pseudonymizing: replacing identifiers with a code or token, keeping the key separately. Re-identification is possible with the key, so it remains personal data (GDPR art. 4.5).

Comparison

Criterion	Anonymize	Pseudonymize
Reversible	No	Yes, with key
Subject to GDPR	No	Yes
Typical use	Publish, share with third parties, open data	Test environments, internal analytics, supervised AI

When to anonymize

• Publication on transparency or open-data portals.
• Official gazettes, judgments, notifications.
• Sharing with third parties without a processing agreement.

When to pseudonymize

• Development and test environments.
• Internal analysis that may need occasional re-identification.
• AI training where traceability is required.

How anonimIA handles both

anonimIA lets you switch between pseudonymizing (for internal workflows with traceability) and anonymizing (for external publication), with an auditable report in both cases.