Pseudonymization vs Anonymization: the Difference, With Document Examples
Pseudonymization replaces identifying data with placeholders ([Person 1], a code, a token) while a separate key can link them back to the person. Anonymization removes the link for good: nobody, not even the person who did it, can tell who the data is about. Under the GDPR, pseudonymized data is still personal data; truly anonymous data is not.
The definitions, in one table
| Pseudonymization | Anonymization | |
|---|---|---|
| What happens | Identifiers replaced by placeholders or codes | Identifiers removed or generalized so nobody can be singled out |
| Reversible? | Yes, with the key kept separately | No |
| GDPR status | Still personal data (Art. 4(5), Recital 26) | Outside the GDPR (Recital 26) |
| Typical use | Sharing a file with an expert or an AI, research datasets, internal analytics | Publishing, open data, statistics |
| Document example | "[Person 1] sold the car to [Person 2]" | "A private individual sold a car to another" |
What the GDPR actually says
Article 4(5) GDPR defines pseudonymisation as processing personal data so that it "can no longer be attributed to a specific data subject without the use of additional information", provided that information is kept separately and protected. Recital 26 then draws the line: pseudonymized data that could be attributed to a person "by the use of additional information" is still personal data; anonymous information is not covered by the regulation at all.
The GDPR treats pseudonymization as a safeguard, not an exit: Article 25 (data protection by design) and Article 32 (security) both name it as an appropriate measure. The European Data Protection Board detailed how to do it properly in its Guidelines 01/2025 on pseudonymisation.
The case law has since added a nuance that matters for sharing documents. In EDPS v SRB (C-413/23 P, 2025), the Court of Justice accepted that whether pseudonymized data is personal data can depend on who holds it: for a recipient who has no reasonable means of re-identifying anyone, it may not be. For you, holding the key, it always is.
The UK GDPR and the Swiss FADP follow the same logic.
What each looks like on a document
Take one sentence from a contract dispute:
Anna Keller, residing at 12 Rue du Lac, Geneva, sold the vehicle to Bella Moreau on 3 March 2026.
Redacted (black boxes):
████████, residing at ████████████, sold the vehicle to ████████ on ███████.
Nothing identifying is left, and nothing useful either: the reader cannot tell whether the two black boxes are the same person.
Pseudonymized:
[Person 1], residing at [Address 1], sold the vehicle to [Person 2] on [Date 1].
Each placeholder is consistent across the document, so the story survives. Whoever holds the table can restore the names.
Anonymized:
A private seller sold a vehicle to a private buyer in early 2026.
Generalized until nobody can be singled out, even with outside knowledge. This is what statistics and published case summaries look like, and it is rarely what you want for a working document.
Which one do you need?
- Sending a file to an AI, an expert, a translator, co-counsel: pseudonymize. The reader needs the structure; you keep the key. See how to anonymize a document before ChatGPT and how law firms pseudonymize case files.
- Filing with a court, answering a public-records or subject-access request: redact the third parties. See how to redact a PDF.
- Publishing data or a decision: anonymize, which usually means pseudonymizing and removing the descriptive details that could single someone out.
Common mistakes
- Calling pseudonymized data "anonymous" in a privacy notice. If you hold the key, it is not.
- Keeping the key next to the data. The key must be stored separately, with tighter access, or the pseudonymization protects nothing.
- Inconsistent placeholders. Replacing the same person with
[Person 1]on page 1 and[Person 3]on page 5 breaks the document for the reader without improving privacy. - Forgetting indirect identifiers. Job titles, rare events, small towns. Removing names is necessary, not sufficient.
- Black boxes that are not real. A rectangle drawn in a PDF editor leaves the text underneath; the file is neither pseudonymized nor anonymized.
Frequently asked questions
Is pseudonymized data personal data under the GDPR? Yes for anyone who can re-identify it, such as the person holding the key. For a recipient with no reasonable means of re-identification, the Court of Justice has accepted it may not be.
Is replacing names with initials pseudonymization? Yes, but weak: initials reveal part of the name and two people can share them. Numbered placeholders like [Person 1] are safer and clearer.
Is redaction the same as anonymization? Redaction removes information from a document. If enough is removed that nobody can be identified, the result is anonymous; if only names are removed and the rest identifies the person, it is not.
What is de-identification? The US term, mostly in health data (HIPAA). It covers both approaches; HIPAA's Safe Harbor method lists 18 identifiers to remove.
Is hashing an email address anonymization? No. A hash of a known value can be recomputed and matched, so it is pseudonymization at best.
Try it on a PDF
Redact PDF AI's pseudonymize mode replaces people, companies and addresses with consistent placeholders across every page and gives you the correspondence table to keep. Your first document is free.