Pseudonymisation vs anonymisation: when is de-identified data still personal data?

The three terms side by side

The UK approach: a spectrum of identifiability

The ICO published its guidance on anonymisation and pseudonymisation on 28 March 2025. ICO, anonymisation guidance, checked Nov 8, 2026 (opens in a new tab) It treats identifiability as a spectrum. Data is effectively anonymised when the risk of anyone being identified is reduced to a sufficiently remote level, judged by the means reasonably likely to be used.

Two tests carry most of the weight:

• The "reasonably likely" test. Consider the cost and time needed to identify someone, the technology available, and other information the holder could get hold of.
• The motivated intruder test. Could a reasonably competent person, with access to the internet and public records and willing to make enquiries, identify anyone? Record the result.

The same data can be personal in one organisation's hands and effectively anonymous in another's. A company that keeps the originals, or the key, still holds personal data even after it shares a pseudonymised copy.

The EU position after EDPS v SRB

On 4 September 2025, the Court of Justice of the EU ruled in EDPS v SRB (C-413/23 P) that pseudonymised data isn't personal data in every case and for every person. CJEU press release, EDPS v SRB (C-413/23 P), checked Nov 8, 2026 (opens in a new tab) For a recipient with no realistic means of re-identifying anyone, it may fall outside the GDPR. For the organisation that holds the key, it stays personal data.

The court also said the sharing organisation's duties don't change. It still had to tell people, before the transfer, who would receive their data. And if a recipient passes the data to someone who can re-identify it, the law applies again.

De-identification in US law

• HIPAA sets two methods: Safe Harbor and Expert Determination. Safe Harbor removes 18 listed identifiers, provided the organisation has no actual knowledge that what remains could identify someone. Expert Determination relies on a qualified expert's documented judgment that the risk is very small. HHS, HIPAA de-identification guidance, checked Nov 8, 2026 (opens in a new tab)
• California's privacy law treats data as deidentified only if the business takes reasonable measures to stop re-identification, publicly commits not to re-identify it, and contractually binds anyone it shares it with to the same.
• Elsewhere there's no single federal standard. Contracts and the Federal Trade Commission's view of what a company promised people usually decide what's acceptable.

Why free text is the hard part

Tables are relatively easy to de-identify: drop or code the name column. Email and chat are harder. Names turn up in greetings, signatures, nicknames, forwarded threads and file names, alongside job titles, places and project names that can identify someone indirectly.

For AI training, the replacement also has to be consistent: the same person becomes the same stand-in every time, so the conversation still makes sense. That usually means a lookup table linking real names to stand-ins, which is a key. Whoever holds it holds pseudonymised data, not anonymous data. How micro1 says it de-identifies company data sets out its approach, its published test results and the questions to ask.

When the de-identification happens in another country

Pseudonymisation only protects people from the moment it's done. If a UK company sends raw records to a US company that de-identifies them there, the transfer is of fully identifiable personal data, and the key stays with the US company. The US company holds personal data. The labs it licenses the copy to may not, if they can't realistically re-identify anyone.

Pseudonymising before the data leaves the UK, and keeping the key in the UK, changes what crosses the border. The UK company still holds personal data, so the transfer rules still apply to it, but much less could be exposed if the data were accessed abroad. My guide to sending the data to the US sets out the safeguards and the questions to ask.

What this means for licensing company data

1. For your organisation, it's personal data. You hold the originals, so you need a lawful basis, a compatibility assessment, a DPIA and proper notices, however well the copy is de-identified.
2. Find out who holds the key. If the buyer de-identifies the data itself, it handles raw personal data and is your processor for that step, at least.
3. Test the output. Run a motivated intruder test on samples before release, and record it.
4. Control onward sharing. The contract should stop recipients re-identifying the data or passing it to anyone who could.

The free UK information governance pack includes a pseudonymisation and re-identification assessment (template 08) built around these questions.

Common questions

What is the difference between anonymisation and pseudonymisation?

Pseudonymisation replaces identifiers but keeps a way to link the data back, so it's still personal data for whoever holds that link. Anonymisation removes the possibility of identifying anyone by means reasonably likely to be used, so data protection law stops applying.

Is pseudonymised data personal data?

Yes, for anyone who holds the key or could realistically re-identify people. For a recipient with no realistic means of doing so, the ICO's guidance and the EU court's 2025 ruling both say it may not be.

Is de-identified data the same as anonymous data?

Not necessarily. De-identified describes a process, and the result can be pseudonymised or anonymous depending on how it was done and who holds what. In US health law it has a specific meaning set by HIPAA.

What is the motivated intruder test?

A check on whether a reasonably competent person, with ordinary resources such as the internet and public records and willing to make enquiries, could identify someone from the data. The ICO recommends running it and recording the result.

What is HIPAA Safe Harbor de-identification?

One of HIPAA's two de-identification methods. It removes 18 types of identifier, such as names, most dates and contact details, provided the organisation has no actual knowledge that what's left could identify someone.

This is a general explanation, not legal advice. I'm not a lawyer. I refer companies to micro1 and may receive a referral fee if one signs up through my introduction.