Anonymize vs Pseudonymize: €20M at Stake
Article 83 sets peak fines at €20 million or 4% of global annual revenue. One legal question drives that risk: does the law apply to your dataset?
Anonymization removes scope. Pseudonymization does not. That gap is large.
The Two Definitions in Plain Terms
Recital 26 sets the bar for anonymization. A person must be "not or no longer identifiable." The test is wide. It covers every means "reasonably likely to be used." That includes the controller. It also covers any processor and any third party.
Article 4(5) defines pseudonymisation. Records are pseudonymized when a key can reverse them. Remove the key, and you still have the data. That extra data must stay separate. It is not anonymization.
Pseudonymized records are still personal records. The law applies in full. There is no scope exemption. Full stop.
What a Wrong Label Costs
Treating a pseudonymized dataset as anonymous creates five problems at once:
- Wrong ROPA entries under Article 30
- No subject rights process for access, erasure, or portability
- No retention schedule — no deletion trigger exists
- No transfer safeguards for cross-border work
- No erasure path for right-to-erasure requests
Each gap is a separate breach. All five can sit in one pipeline.
The 2025 Enforcement Signal
In 2025, the EDPB ran a joint enforcement exercise. The report named one recurring failure: "inefficient anonymisation techniques used as an alternative to deletion." DPAs now audit the quality of anonymization. They check more than just whether a step exists. The step must work.
A tokenized dataset with a lookup table is pseudonymized. It is not anonymous. It has a key. The key can reverse it. Calling it anonymous is exactly the failure the 2025 report targets.
Picking the Right Method
True anonymization — outside scope. Use Redact. PII is gone with no link back. You can also Hash high-entropy values with no preimage path. Document the basis. No legal duties attach to the output.
Pseudonymization — inside scope. Use Replace, Mask, or Encrypt. The law applies in full. Pseudonymization cuts harm from a breach. It does not cut legal duties.
Controlled reversibility — research or audit. Use Encrypt with client-held keys. Key custody must meet EDPB 05/2022 key separation rules. Note the domain in the DPIA.
A Real Use Case
A company sells "anonymized" customer records to researchers. They apply the Redact method. PII is gone. No token table. No hash preimage. Re-identification has no path.
The DPO writes this in the DPIA. Method used. Identifier types. Why it cannot be undone. Residual risk level. The output falls outside scope. Subject rights and transfer rules do not apply to the research copies.
The method matches the claim. That is the correct process. It holds up in an audit.
Why the Record Matters
A company cannot just assert anonymization. The claim must have a record. The DPIA must show four things. Which identifiers were covered. Which method was used. Why re-identification has no path. What the residual risk level is.
Without that record, an audit treats the dataset as in scope. The full set of duties applies. The ROPA entry must exist. The transfer safeguards must exist. The erasure path must exist. No duties go away without proof.
For how erasure rights interact with anonymized records, see GDPR right to erasure and the EDPB 2025 guidance. For transfer rules when sharing records cross-border, see data transfer compliance and the TikTok fine.