Direct comparison
Anonymization vs. Pseudonymization
Anonymization is irreversible and exits GDPR scope; pseudonymization is reversible and stays in scope. Compare techniques, legal basis, and use cases.
Ask about Anonymization vs. Pseudonymization
Answers are drawn from this comparison and the rest of the CASRAI corpus, with a link to every source.
Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this
How do Anonymization, Pseudonymization compare side by side?
The table below compares Anonymization, Pseudonymization across 10 procurement-relevant dimensions, from what it does through risk if done incorrectly.
Side-by-side comparison
| Dimension | Anonymization | Pseudonymization |
|---|---|---|
| What it does | Irreversibly removes or alters identifying information | Replaces identifiers with a code/token; original identity recoverable via a separately-held key |
| Reversibility | Not reversible, by definition | Reversible by anyone with access to the key file |
| GDPR status | Falls outside GDPR scope entirely (Recital 26) once genuinely anonymous | Remains personal data — GDPR still applies in full (Article 4(5), Recital 26) |
| GDPR basis | Not defined as a processing operation with its own article; outcome described in Recital 26 | Defined in Article 4(5); named as a research safeguard in Article 89(1) |
| Re-contacting participants | Not possible — no link back to identity exists | Possible via the key file, subject to access controls |
| Typical techniques | Suppression, generalization, perturbation, k-anonymity, differential privacy, synthetic data | Coded/tokenized identifiers, encryption with a separately-stored key, linkage tables |
| Key file / crosswalk | None exists — destroyed or never created | Exists, stored separately with access controls |
| Comparable US standard | HIPAA Safe Harbor / Expert Determination (45 CFR 164.514(a)-(b)) removes data from PHI scope | No exact HIPAA equivalent — coded data with a retrievable key generally remains PHI |
| When typically used in research | Public repository deposit, long-term archiving, once re-contact is no longer needed | Active data collection and analysis, when re-contact or correction may be needed |
| Risk if done incorrectly | Re-identification via combination with other datasets (quasi-identifier linkage) | Key file exposure or weak access controls defeat the protection |
Common questions
Common questions about Anonymization vs Pseudonymization
Is pseudonymized data still personal data under GDPR?
+
Yes. GDPR Recital 26 states that pseudonymised data which could be attributed to a person using separately-held additional information is still considered information on an identifiable natural person, so it remains fully within GDPR's scope.
Can anonymized data be re-identified later?
+
If it truly meets the anonymization standard, no — by definition, re-identification must not be possible by any means reasonably likely to be used, accounting for cost, time, and available technology. If a dataset can later be re-identified by reasonably available means, it was not properly anonymized in the first place.
Does deleting the key file turn pseudonymized data into anonymized data?
+
It can move it toward anonymization, but only if no other reasonably available means of re-identification remain — for example, no other copy of the key exists anywhere, and the data cannot be re-linked by combining it with other accessible datasets. This should be assessed and documented, not assumed.
Which one should a data management plan specify?
+
State explicitly which technique is used at which stage — for example, pseudonymized during active collection and analysis, anonymized before public deposit — rather than using the terms interchangeably. Funders and ethics boards increasingly expect this level of specificity.
