Anonymisation: when personal data stops being personal

What anonymisation means in data protection

The GDPR does not define anonymisation in its articles. Recital 26 describes the outcome instead: information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous so that the data subject is not, or is no longer, identifiable. Data protection principles do not apply to such information, including when it is used for statistical or research purposes. The UK GDPR keeps the same approach.

The defining feature is practical irreversibility. It is not enough that the data is hidden at first glance. If someone keeps a lookup table, if the text still sits under a black box or if the context gives the person away, the result is not anonymous. When re-identification is possible with additional information, you have pseudonymisation, and the data remains personal data.

One point is often missed: anonymising is itself processing of personal data. The European Data Protection Board (EDPB) Guidelines 02/2026 stress that it needs a lawful basis and should be documented, usually the same basis as the processing that came before it.

The “means reasonably likely” test

To decide whether someone is identifiable, GDPR Recital 26 asks you to consider all the means reasonably likely to be used, by the controller or by another person, including singling out. What is reasonable depends on objective factors: the cost and time needed to identify someone, the technology available at the time of processing and how it develops.

The standard is not zero risk. In the UK, ICO guidance frames it through the “motivated intruder”: a reasonably competent person with no special skills who wants to identify individuals using public resources. In the EU, after the Court of Justice judgment in Case C-413/23 P (EDPS v SRB, 4 September 2025), the assessment is made from each party’s perspective, so data can be anonymous for a recipient yet personal for the organisation holding the key.

Techniques and criteria: WP29 Opinion 05/2014 and newer guidance

Article 29 Working Party Opinion 05/2014 was the European reference for a decade. It grouped techniques into randomisation (noise, permutation, differential privacy) and generalisation (aggregation, k-anonymity, l-diversity) and tested three risks: singling out, linkability and inference.

In July 2026 the EDPB adopted Guidelines 02/2026 on anonymisation, open for consultation until 30 October 2026. They update the opinion with three reworked criteria (no record isolation, no linkage, no inference) and two assessment approaches, contextual and simplified. In the UK, the ICO publishes its own anonymisation and pseudonymisation guidance, currently under review following the Data (Use and Access) Act 2025.

In the US the usual term is de-identification. For health data, the HIPAA Privacy Rule offers two routes: Safe Harbor, which removes a defined list of identifiers, and Expert Determination, where a qualified expert confirms the re-identification risk is very small.

Anonymising is not deleting or redacting badly

Anonymising documents in practice

In documents, personal data is not tidy. It shows up in headers, body text, quotations, signatures, scanned stamps and file metadata. A fictitious tribunal decision describing “the head teacher of the only primary school in the village” identifies someone without naming them. Good practice is to look for direct and indirect identifiers and to have a person review the result.

Anonimatum combines its own AI, run on servers in the European Union, with patterns (passport and ID numbers, IBAN, phone, email) and visual zones to find that data, then genuinely removes the marked text and the metadata. See how it works in the PDF anonymiser or compare approaches in anonymisation vs pseudonymisation.