Anonymization vs. pseudonymization: a practical guide

In GDPR vocabulary, anonymization and pseudonymization are concepts often confused, yet they have very different legal implications. Choosing the wrong technique can mean remaining subject to all GDPR obligations when you thought you had eliminated them, or losing the ability to reconnect data when you need it.

Key definitions under GDPR

When to use each technique

• Anonymization: document publication, open reports, training with real cases, sharing with third parties without a processing agreement.
• Pseudonymization: internal analysis, clinical research, periodic audits where you need to reconnect data later.
• Combination: pseudonymize during internal processing and anonymize before any external output.

Common mistakes

Many organizations believe hiding a name with a black rectangle equals anonymization. If the ID number, phone, or address remain recoverable, there is no real anonymization. Another common mistake is pseudonymizing with a key stored in the same system: if an attacker accesses the server, they can reverse the process.

• Verify irreversibility with technical tests, not just visually.
• Separate pseudonymization keys in a distinct store with restricted access.
• Document the legal basis for processing in both cases.