De-identification, anonymization and pseudonymization all describe removing the link between data and the people in it. In everyday use they mean roughly the same thing. In law they don't, and the difference decides whether privacy rules still apply to a dataset after you've cleaned it, and therefore what you and a buyer still owe the people in it.
The short version. Anonymized data is outside data protection law because nobody can reasonably be identified from it. Pseudonymized data is still personal data. De-identified usually means a specific legal standard, like HIPAA's or California's. Company records cleaned for AI training are usually pseudonymized at best, so plan as if privacy law still applies.
What each term means
| Term | Where it's defined | What it means | Still regulated? |
|---|---|---|---|
| Anonymization | GDPR and UK GDPR | Data that no longer relates to an identifiable person, taking into account all the means reasonably likely to be used to identify someone. | No. Truly anonymous data falls outside data protection law. |
| Pseudonymization | GDPR and UK GDPR | Data that can't be linked to a specific person without additional information, such as a key, kept separately and protected. | Yes. It reduces risk but the data is still personal data. |
| De-identification | HIPAA | Health information that meets the Safe Harbor method (18 types of identifiers removed) or an expert's determination that re-identification risk is very small. | No longer protected health information under HIPAA. |
| Deidentified | California (CCPA) | Information that can't reasonably be linked to a consumer, provided the business takes reasonable measures, publicly commits not to re-identify it, and binds recipients by contract. | Outside the CCPA's definition of personal information, if all three conditions are met. |
Anonymization under GDPR and UK law
GDPR doesn't apply to anonymous information, meaning data that doesn't relate to an identified or identifiable person. To decide whether someone is identifiable, you have to consider all the means reasonably likely to be used to identify them, including cost, time and available technology (EUR-Lex).
The UK Information Commissioner describes identifiability as a spectrum and says anonymization has to make the risk of identification sufficiently remote. It also notes that knowingly or recklessly re-identifying de-identified personal data, without the consent of the organization that de-identified it, is a criminal offence under the UK Data Protection Act 2018 (UK Information Commissioner's Office).
Pseudonymization
GDPR defines pseudonymization as processing data so it can no longer be attributed to a specific person without additional information, which is kept separately and protected (EUR-Lex). Swapping every name in a ticket archive for a consistent label like Customer 17 is pseudonymization if anyone still holds the mapping.
Pseudonymized data is still personal data. It is recognized as a useful safeguard, and the European Data Protection Board published guidelines in January 2025 on how to do it well (European Data Protection Board, January 2025), but it doesn't take a dataset outside the law. If you license pseudonymized data, the buyer becomes responsible for personal data too, with everything that involves.
De-identification under HIPAA
HIPAA uses de-identification for health information and recognizes two ways to achieve it: the Safe Harbor method, which removes 18 types of identifiers and requires that you have no actual knowledge the rest could identify someone, and Expert Determination, where a qualified expert concludes the risk of identification is very small (US Department of Health and Human Services). Data that meets either standard is no longer protected health information.
Deidentified under California law
The CCPA defines deidentified information as information that can't reasonably be used to infer information about, or be linked to, a particular consumer. It adds three conditions for the business holding it: take reasonable measures so it can't be associated with a consumer or household, publicly commit to keep it deidentified and not to re-identify it, and contractually require any recipient to do the same (California Civil Code). For a licensing deal, the last condition means the license itself has to carry a no re-identification clause.
How re-identification happens
Removing names is rarely enough, because the remaining details combine into something unique. Latanya Sweeney found that 87% of the US population was likely unique based on just ZIP code, gender and date of birth (Latanya Sweeney, Data Privacy Lab, 2000). A 2019 study estimated that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes (Rocher, Hendrickx and de Montjoye, Nature Communications, July 2019).
Company records add risks of their own:
- Free text. Tickets, chat and code reviews mention names, roles, places and events in sentences that pattern matching misses.
- Small teams. "The finance lead in the Denver office" identifies one person even without a name.
- Rare events. An outage, a lawsuit or a large customer win can be matched to news coverage.
- Linking. Dates, amounts and product names can be matched against public filings, social media or another dataset the buyer holds.
De-identification techniques
NIST's guide to de-identifying government datasets is a good technical reference for these methods and for the governance around them (NIST, September 2023). In practice, most company datasets need a combination.
| Technique | What it does | Strength | Cost |
|---|---|---|---|
| Suppression | Removing a field or value entirely, such as deleting names or signatures | Simple and certain | Loses whatever the field told you |
| Pseudonymization | Replacing identifiers with consistent tokens, like Customer A | Threads still make sense | Still personal data while a key exists |
| Generalization | Replacing exact values with ranges or categories: ages to bands, dates to months, towns to regions | Keeps patterns | Too coarse and the data loses meaning |
| Perturbation | Adding noise to numbers or shifting dates by a random offset | Keeps statistical shape | Not suited to text, and can mislead |
| Aggregation | Reporting counts and totals instead of individual records | Strong protection | Useless for training on individual tasks |
| Synthetic data | Generating new records that mimic the real ones | No real person in the output, if done well | Can leak details the generator memorized |
What this means for licensing company data
- Assume pseudonymized, not anonymous. Records that keep the structure of real work usually keep enough detail to fall short of anonymization. Plan for privacy law to apply.
- Destroy or lock away the key. If you replaced names with tokens, the mapping stays inside your company or gets deleted. It never goes to the buyer.
- Write the standard into the contract. Name the standard the delivery must meet and include a ban on re-identification, which California law requires anyway.
- Test, don't assume. Have people who know the business try to work out who is involved in a sample. Our guide to anonymizing company data covers how.
- Treat health data separately. Meet a HIPAA method in full or leave it out. A limited data set needs a data use agreement.
Common questions
Is pseudonymized data anonymous?
No. Under GDPR, pseudonymized data is still personal data, because it can be linked back to a person with additional information. Only data that can no longer identify anyone, taking into account the means reasonably likely to be used, falls outside the law.
Is de-identified data the same as anonymized data?
Not exactly. De-identified usually refers to a specific legal standard, such as HIPAA's Safe Harbor or Expert Determination methods, or the CCPA's definition. Anonymized, under GDPR and UK law, means the risk of identifying anyone is sufficiently remote. Data can meet one standard and fail the other.
Does HIPAA de-identification satisfy GDPR?
Not automatically. The two laws use different tests. HIPAA's Safe Harbor method removes a fixed list of identifiers, while GDPR asks whether anyone could still be identified by means reasonably likely to be used. If the data covers people in the EU or UK, assess it against GDPR separately.
Is synthetic data anonymous?
It can be, but not by default. Synthetic data generated from real records can still reveal details about the real people if the generator memorized them. Test it for re-identification risk the same way you would any other cleaned dataset.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- European Data Protection Board, January 2025: Guidelines 01/2025 on pseudonymisation
- UK Information Commissioner's Office: Anonymisation guidance
- US Department of Health and Human Services: Guidance on de-identification of protected health information
- California Civil Code: Section 1798.140 (CCPA definitions, including "deidentified")
- NIST, September 2023: SP 800-188, De-identifying government datasets: techniques and governance
- Latanya Sweeney, Data Privacy Lab, 2000: Simple demographics often identify people uniquely
- Rocher, Hendrickx and de Montjoye, Nature Communications, July 2019: Estimating the success of re-identifications in incomplete datasets using generative models