Privacy & Compliance
Pseudonymization vs Anonymization: What's the Difference?
- GDPR Art. 4(5)
- Recital 26
- Re-identification
Short answer
Pseudonymized data can still be linked to a person using extra information kept separately, such as a token store or key, so GDPR still applies to it (Article 4(5)). Anonymized data can no longer be linked to anyone by means reasonably likely to be used, so GDPR no longer applies (Recital 26). Most masking in practice is pseudonymization.
What does GDPR actually say?
Article 4(5) of the GDPR defines pseudonymization (the regulation spells it "pseudonymisation") as processing personal data so that it "can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures" to keep it from being re-attributed.
Recital 26 sets out the consequence. Pseudonymized data that could be attributed to a person with additional information "should be considered to be information on an identifiable natural person". To decide whether someone is identifiable, you account for all means "reasonably likely to be used", considering cost, time and available technology. And the principles of data protection "should therefore not apply to anonymous information".
So the test isn't whether a name is missing. It's whether anyone could reasonably get back to the person.
Pseudonymization vs anonymization side by side
| Pseudonymization | Anonymization | |
|---|---|---|
| Can be linked back to a person? | Yes, with additional information kept separately | No, by any means reasonably likely to be used |
| Still personal data under GDPR? | Yes, for whoever can reverse it | No |
| GDPR applies? | Yes, but it counts as a safeguard | No |
| Reversible? | By design, for the key or token holder | No, by definition |
| Keeps usefulness | High: records stay linkable | Lower: detail is removed or generalized |
| Typical techniques | Tokenization, keyed hashing, format-preserving encryption | Aggregation, generalization, suppression, noise |
| Legal reference | Art. 4(5), also Arts. 6(4), 25, 32, 89 | Recital 26 |
What do regulators and courts say?
- EDPB. The European Data Protection Board adopted Guidelines 01/2025 on pseudonymisation for public consultation on 16 January 2025. They confirm that pseudonymized data which could be attributed using additional information remains personal data, and introduce the idea of a "pseudonymisation domain": the environment in which the data can't be attributed to specific people. As of October 2026, check the EDPB site for the final version.
- ICO (UK). The Information Commissioner's Office published its guidance on anonymisation and pseudonymisation on 28 March 2025. It treats identifiability as a spectrum that depends on context, uses the "motivated intruder" test, and accepts that the same data can be personal in one organization's hands and anonymous in another's. As of October 2026, the ICO says the guidance is under review because of the Data (Use and Access) Act.
- CJEU. In EDPS v SRB (C-413/23 P, 4 September 2025), the Court of Justice held that pseudonymized data passed to a recipient isn't necessarily personal data from that recipient's point of view, if the recipient can't reasonably re-identify anyone. It remains personal data for the controller who holds the key.
Read together: pseudonymization never takes the data out of GDPR for you, but how it looks to a recipient depends on what that recipient could realistically do. That's an argument for doing it well, not for skipping the rest of GDPR. This is not legal advice.
Where do common techniques land?
| Technique | Usually | Why |
|---|---|---|
| Reversible tokenization | Pseudonymization | The token store links tokens back to people |
| Keyed hash (HMAC) of an email | Pseudonymization | Anyone with the key can hash a known email and match it |
| Unkeyed hash of an email | Pseudonymization at best | Emails can be guessed and hashed by anyone |
| Format-preserving encryption | Pseudonymization | Decryptable with the key |
| Redacting direct identifiers only | Often still personal data | Quasi-identifiers like job, town and age remain |
| Aggregated counts with small cells suppressed | Can be anonymization | No row relates to one person |
Why does pseudonymization still matter if GDPR still applies?
Because GDPR rewards it. Article 25 names it as an example of data protection by design. Article 32 lists it as a security measure. Article 6(4) counts it as a factor when assessing whether further processing is compatible with the original purpose, and Article 89 points to it for research and statistics. In a breach, pseudonymized data whose key wasn't exposed is a very different conversation with a regulator from a spreadsheet of names and IBANs.
What does this mean for AI prompts?
Masking personal data before a prompt reaches an AI provider is pseudonymization. Your organization still processes personal data, so you still need a legal basis, transparency and a processor agreement where relevant. What changes is what the provider receives. If a support prompt goes out as "mf_mask_170b... asks about her CHF 2,400 refund", the provider gets a token, not Ada Lovelace.
With Maskflare the originals behind tokens stay in its store, kept encrypted for 30 days for restoring, and never go to the provider. Prompts and responses aren't logged or stored. The GDPR compliance profile and the compliance coverage report, which maps detectors to GDPR personal-data categories, help you document the measure. See GDPR and AI and the EU AI Act checklist.
What are the common mistakes?
- Calling hashed emails anonymous. They're pseudonymized at best.
- Forgetting free text. A ticket that says "my husband, the mayor of Schaan" identifies someone with no name in it.
- Keeping the key next to the data, which defeats the "kept separately" condition in Article 4(5).
- Assuming anonymous forever. New data sources can make old datasets identifiable again. Review it.
Frequently asked questions
Is pseudonymized data personal data?
Yes, for anyone who can reverse it. Recital 26 says so directly. For a recipient that can't reasonably re-identify anyone, the CJEU said in 2025 that it may not be. Not legal advice.
Is tokenization pseudonymization or anonymization?
Reversible tokenization is pseudonymization: a separately kept token store links tokens back to people.
Is hashing anonymization?
Usually not. Hashed identifiers can often be matched by hashing known values, so they're treated as pseudonymized.
Does GDPR apply to anonymized data?
No. Recital 26 says the data protection principles don't apply to anonymous information, but the bar for true anonymity is high.
Does masking prompts make AI use GDPR compliant?
No single measure does. Masking is a strong safeguard, but you still need a legal basis, transparency, contracts and the rest of GDPR.