Pseudonymisation vs anonymisation: the practical difference
Changing “Maria Lopez” to “PERSON_1” is usually pseudonymisation, not anonymisation. Pseudonymised data remains personal data when it can be linked back to someone using additional information.
What pseudonymisation does
It replaces identifiers with labels, codes or invented values while retaining useful structure. It can reduce risk and support minimisation. If a lookup table exists, or context reconstructs identity, the GDPR still applies.
- Keep any lookup table separate and protected.
- Avoid reusing the same pseudonym across projects unless necessary.
- Restrict access to both the source and additional information.
What an anonymisation claim requires
Removing direct identifiers is not enough. Consider whether one person can be singled out, whether records can be linked and whether attributes can be inferred. The information and reasonable means available to a recipient also matter.
- Define who might re-identify someone and which sources they could use.
- Assess rare combinations, not only individual fields.
- Review risk when context, data or recipients change.
A contract example
Replacing names and identity numbers with CLIENT_A and PERSON_1 preserves legal meaning, but an address, date, counterparty and public amount may reveal the matter. The copy can be useful and less exposed without becoming anonymous.
- Keep only details needed for the task.
- Generalise unnecessary quasi-identifiers.
- Label the file as pseudonymised when that is the accurate status.
How to document a cautious decision
Record purpose, removed data, retained context, recipients and review. No technique works universally: the threshold depends on the dataset, environment and reasonable ability to re-identify.
- Assign a responsible reviewer.
- Keep criteria and date, not just the output.
- Escalate to privacy or legal specialists when impact is high.
Limitations to keep in mind
- Privalume uses substitutions and local rules; it does not certify anonymisation under the GDPR.
- Context can identify someone without names or formal identifiers.
- Re-identification risk changes as sources and recipients change.