Anonymization vs. pseudonymization: the difference under the GDPR

The difference in one sentence

Pseudonymization replaces direct identifiers (name, email address, phone number) with placeholders or codes, but keeps, somewhere, a way back to the original person: a mapping table, a context that can be reconstructed, additional information kept separately. Anonymization goes further: it removes that way back, so that it is no longer reasonably possible to find the person, even by cross-referencing several sources. It is this possibility of re-identification, or its absence, that separates the two notions under the GDPR, and that determines whether or not a document remains subject to the regulation.

What Article 4 of the GDPR says about pseudonymization

Article 4(5) of the GDPR defines pseudonymization as the processing of personal data in such a way that it can no longer be attributed to a specific person without the use of additional information, provided that such additional information is kept separately and protected by technical and organizational measures. In other words, the text presents pseudonymization as a security measure, recommended by the GDPR, but not as a way out of the regulation’s scope.

In practice: a file in which names have been replaced with codes remains a file of personal data if someone, somewhere, holds the key to link those codes to the real people. This also applies if the key does not formally exist but re-identification remains possible by cross-referencing (dates, positions, places, amounts that make it possible to guess who is behind the placeholder).

What Recital 26 says about anonymous data

Recital 26 of the GDPR specifies that the regulation does not apply to anonymous information, that is, data that does not relate to an identified or identifiable person, or that has been rendered anonymous in such a way that the person is no longer identifiable at all. This is the only situation in which a document that originally contained personal data can fall completely outside the scope of the GDPR.

The difficulty, in practice, is that this threshold is demanding: removing the names is not enough. You have to make sure that no combination of the remaining information makes it possible to trace back to the person, including by cross-checking the document with other sources available publicly or internally.

Why this distinction really matters

This distinction is not just theoretical. A pseudonymized document remains subject to all GDPR obligations: legal basis for processing, retention period, data subjects’ rights, storage security. An anonymous document is not. Confusing the two can lead you to treat as “risk-free” a file that is, in reality, personal data to be protected.

The penalties at stake are not symbolic: Article 83 of the GDPR provides for fines of up to €20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements. In France, the CNIL is the authority responsible for enforcing the regulation and imposing these penalties. The same caution applies when a document goes to a third-party tool: our article anonymize a document before sending it to ChatGPT or another AI explains why simply replacing names is not always enough before sending something outside.

Concrete examples: pseudonymization or anonymization?

Replacing a name with a stable placeholder such as “[PERSONNE_1]” in a document is a pseudonymization technique: it greatly reduces the risk in practice, but as long as the document keeps contextual elements that make it possible to guess who is behind the placeholder (a unique position in the organization, a precise date, an identifiable place), re-identification remains possible and the document keeps its status as personal data.

The open data of court decisions in France illustrates, conversely, an approach that aims at anonymization. The 2016 Digital Republic Act (loi pour une République numérique) and then the 2018-2022 Justice Programming Act organized public access to court decisions, provided that the last and first names of individuals who are parties or mentioned in the judgment are concealed. The aim is indeed to prevent identification of the people concerned before publication, not just to mask a name on the surface. For practitioners dealing with this type of document, our guide anonymizing a judgment or court documents: a guide for lawyers and in-house counsel explains the steps.

How to get closer to anonymization

There is no magic button that turns a pseudonymized document into an anonymous one: it is a case-by-case assessment, taking into account the document and the context in which it is shared. A few habits help get closer:

• Look not only for direct identifiers (names, email addresses, phone numbers) but also for indirect ones: a precise position, rare dates, uncommon places, specific amounts.
• Check whether the combination of the remaining information, even without a name, points to only one possible person in the context of the document.
• Destroy, not just move, any mapping table between placeholders and real people if the goal really is anonymization rather than pseudonymization.
• Check the file’s metadata, which may contain information about the author or the revision history.
• Have a person review the result: no automatic tool is 100% reliable at judging the remaining level of re-identification.

Tools such as Adobe Acrobat Pro, or dedicated applications, help find and replace identifiers in a PDF; our pillar article how to anonymize a PDF for free, without uploading it compares the available methods, including free ones.

AnonymFiles is clearly on the pseudonymization side, and says so: it replaces identifiers with stable placeholders ([PERSONNE_1], [ORGANISATION_1]…) across an entire folder, and the mapping table stays on your computer, never in the exported copies (see where the mapping table stays). Once the app is installed, everything happens offline, with no account, no online license check, no telemetry and no cloud chat; you review each original against its copy before export, and the local MCP server exposes only the approved copies to AI agents such as Claude Code or Codex. To aim for true anonymization, you still need to handle indirect identifiers and delete the mapping table, with a human review.

Pseudonymization tools

Three families of tools exist for pseudonymizing documents, depending on who uses them and where the text goes:

The European Data Protection Board (EDPB) put its Guidelines 01/2025 on pseudonymization out for public consultation until March 14, 2025. It points out that pseudonymized data, which can be linked to a person through additional information such as a mapping table, remains personal data. To compare the software on the market on concrete criteria, see our comparison of anonymization software.