Ask the DPO: Anonymization vs. Pseudonymization

Written by: Guy Bakshi

In this monthly “Ask the DPO,” our Head of DPO Services, Guy Bakshi, addresses a frequently misunderstood distinction – anonymization versus pseudonymization – in light of a key CJEU ruling and the European Data Protection Board’s (EDPB) Guidelines 02/2026 on Anonymisation, adopted for public consultation on 7 July 2026 (the “Guidelines”).

In EDPS v SRB, the Court of Justice of the EU (CJEU) confirmed that pseudonymized data is not necessarily personal data for every recipient; it depends on the means reasonably likely to be used by that recipient to identify the individuals. The same dataset can thus be anonymous for one entity and personal data for another. The Guidelines turn this contextual approach into a practical framework, with important limits, particularly for processors. To see why organizations cannot simply relax their safeguards, we start with the basics.

Two Concepts, One Critical Difference

Anonymization – processing that renders personal data no longer related to an identified or identifiable individual. Under the GDPR, identifiability (and thus irreversibility) is judged by the means reasonably likely to be used from the applicable perspective, not in absolute terms. Data anonymous from that perspective falls outside the GDPR, though it may remain personal data for another entity. Anonymization therefore need not involve deleting the source data or eliminating identifiability for everyone.

Pseudonymization – processing personal data so that it can no longer be attributed to a specific individual without additional information, which is kept separately and protected by measures preventing attribution. In short, pseudonymized data cannot, by itself, be linked to the person concerned.

For example:

Personal Data: John Doe, Age 34, Orlando, Florida.

Pseudonymized Data: ABCD XYZ, Age 34, Orlando, Florida.

The critical difference is not whether names have been removed or coded. Pseudonymized data remains personal data for any entity that can identify individuals using separately held information or other reasonably likely means, though it may be anonymous for an independent recipient lacking such means. The assessment must also consider whether a code or combination of attributes allows individuals to be singled out and treated differently, even without learning their names.

Why the Distinction Matters

Mistaking pseudonymized data for anonymized data creates serious compliance and business risks. Under the Guidelines, where an entity processes data on behalf of a controller, the controller’s perspective governs: if the information is personal data for the controller, the processor must treat it as such, even if it cannot itself identify the individuals. Pseudonymization therefore does not relieve a processor of its regulatory or contractual obligations.

Pseudonymization remains valuable as a risk-reduction and security measure – compare a breach exposing identifying data with one exposing pseudonymized data. In clinical trials it is effectively required: the EU Clinical Trials Regulation and Medical Device Regulation framework, with Good Clinical Practice, contemplates that data reaching the sponsor is coded so the sponsor does not receive directly identifying information.

Before You Anonymize

Anonymization can take data outside the GDPR for an entity from whose perspective it is anonymous, but does not automatically disapply a data processing agreement or other contractual restrictions. It is itself processing: it requires a legal basis and, where relevant, a special category condition, and a processor may anonymize only on the controller’s documented instructions.

The Guidelines offer two ways to structure the assessment: a contextual approach, considering the relevant entities’ capabilities and circumstances, and a simplified approach, conservatively disregarding differences in their access to information and resources. The latter is not a separate legal standard; an identification method it reveals can then be tested for whether it is reasonably likely to be used in context. Both apply three criteria – No Record Isolation, No Linkage and No Inference. Passing all three supports anonymity; failing one calls for further analysis rather than automatically meaning the data is personal. Contractual bans on re-identification can support technical safeguards but are not equivalent to a legal prohibition and should not be relied on alone.

In practice, organizations should identify for whom the data is meant to be anonymous, establish the applicable perspective, and document the process and testing. The EDPB recommends periodic reassessment, as new technology, additional information or a security incident may change the likelihood of identification. Organizations should be transparent about anonymization and avoid calling data anonymous where individuals remain identifiable.

The CJEU Ruling: It Depends on Who Is Looking

For an independent recipient determining its own purposes and means, the assessment generally turns on its own perspective. In our example, “ABCD XYZ, Age 34, Orlando, Florida” is anonymous for that recipient only if individuals are not identifiable by reasonably likely means. Being unable to link the code to John Doe is not enough: identification through the attributes, external information or accessible third-party resources must also be considered. A processor, by contrast, cannot rely on its own inability to identify individuals.

Nor is the controller off the hook: if the information remains personal data for it, all applicable GDPR obligations continue to apply. In EDPS v SRB, the Court assessed the information obligation from the controller’s perspective at collection, so a controller cannot omit required information about recipients merely because the data will be anonymous for them.

A Word of Caution for Regulated Sectors

Organizations, particularly in highly regulated sectors, should not rush to rely on this approach. A clinical trial sponsor receiving only coded data might seem to fit squarely within the ruling, given the measures sites, sponsors, CROs and others adopt to keep identifying data at the site. However, the GDPR, the Clinical Trials Regulation, the Medical Device Regulation and Good Clinical Practice overlap. Until industry and regulators provide clearer alignment, sponsors should continue to treat pseudonymized trial data as personal data in line with established requirements.

The Key Takeaway

Anonymity is contextual, not a label attached to a dataset. Organizations should identify the applicable perspective, test and document identifiability, and reassess as circumstances change. Independent recipients may hold anonymous data even where the disclosing controller holds personal data, but processors must apply the controller’s perspective. The Guidelines are a practical framework, not a blanket exemption: transparency, contractual commitments and sector-specific requirements still need separate attention.

The Cyber, Privacy & Copyright Group – Pearl Cohen Zedek Latzer Baratz