Pseudonymization or redaction: what's the difference, and which should you choose?

What is the difference between pseudonymization and redaction?

The difference shows after sharing. With pseudonymization you can go back: a table links each label to the real value, and whoever holds it can restore everything. With redaction you can't: the information is gone from the document, and the recipient has no key.

The same sentence, three ways:

• Original: "Ms Claire Vasseur signed the lease with SCI Les Tilleuls on March 3."
• Pseudonymized: "[PERSONNE_1] signed the lease with [ORGANISATION_1] on March 3." The table, kept separately, says that [PERSONNE_1] is Claire Vasseur.
• Redacted: the same sentence with black boxes where the name and company were, and nothing left underneath in the file.

Both techniques hide the same information. What changes is whether it can be recovered, and therefore what each is for.

What do the texts say about pseudonymization and redaction?

Pseudonymization is defined by the GDPR. Article 4(5) describes it as processing personal data "in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately" and protected by technical and organizational measures. That additional information is the mapping table. Recital 26 draws the consequence: pseudonymized data that can be attributed to a person using that information is still personal data.

Redaction has no GDPR definition. French law calls it "occultation". Article L311-7 of the French Code of Relations between the Public and the Administration (CRPA) provides that when an administrative document contains non-disclosable details that can be redacted or separated out, the document is released to the requester after that redaction or separation. The details at stake include those that would infringe privacy (Article L311-6).

Anonymization is a third concept. It requires that the person no longer be identifiable at all, by any reasonable means: the data then falls outside the GDPR (Recital 26). A redacted document is not automatically anonymous: if a unique job title or a precise date remains, the person may be recognized. More: anonymization vs pseudonymization under the GDPR.

Reversible or final: what role does the mapping table play?

Everything rests on it. The mapping table ("[PERSONNE_1] = Claire Vasseur") is what makes pseudonymization reversible. The GDPR requires it to be kept separately and protected; the European Data Protection Board (EDPB) devotes its Guidelines 01/2025 on pseudonymization, adopted January 16, 2025, to the subject. Three practical consequences:

• Whoever holds the table processes personal data. The firm or company remains subject to the GDPR for that data, pseudonymized or not.
• For the recipient, things may differ. In EDPS v SRB (C-413/23 P), decided on September 4, 2025, the Court of Justice held that pseudonymized data must not be regarded as personal data in all cases and for every person (paragraph 86): it depends on the means available to whoever receives it.
• Destroying the table brings you closer to redaction. Without the table, nobody can restore the labels. But indirect identifiers remain in the text.

Redaction has no table: that is its strength for a document going out, and its limit for work you want to pick up again. You still need to keep the original intact, separately. On keeping and protecting the table: the pseudonymization mapping table under the GDPR.

When should you redact?

Whenever the document leaves your control and the recipient has no need to know the hidden information:

• Sharing with a third party. A document sent to opposing counsel, to the other side, to an expert, to a client who must not see another client's data, to an insurer.
• Access requests for administrative documents. A French local authority or public body releasing a document under the CRPA must redact protected details. The CADA (the French commission for access to administrative documents) notes that refusing the whole document is only allowed when partial redaction would make it unintelligible or of no interest (opinion no. 202507226 of November 20, 2025). See CADA requests: redact before releasing.
• Publication. A court decision released, a report put online, an example in a training session: see anonymize a court decision.
• Answering a data subject access request. Under the GDPR, the right to obtain a copy "shall not adversely affect the rights and freedoms of others" (Article 15(4)): other people's data in the documents is masked before sending.

In every case, the technical requirement is the same: the text must actually be removed from the file, metadata included. A black box drawn in a PDF editor leaves the text underneath, readable with a simple copy and paste: see why black boxes fail as PDF redaction and how to check an anonymized PDF.

When should you pseudonymize?

Whenever you need the result back with the real information:

• Working with an AI. You send ChatGPT, Claude or Mistral a contract, a brief or a case file; the AI drafts, summarizes or analyzes; then you put the real names back into its answer. This is the typical use: see pseudonymize a document for AI, then restore the real names.
• Internal analysis with outside help. A tracking sheet shared with a contractor who doesn't need the names, but whose results you must be able to link back to your files.
• Studies and statistics. Data you want to update or cross-check later.

With an AI, pseudonymization has a second, often underrated advantage: it keeps the text meaningful. If every name becomes the same black box or the same "[XXX]", the AI no longer knows who did what, and its answer becomes useless. Stable labels, where the same person stays [PERSONNE_1] across all documents, let it reason about the file without knowing anyone.

Pseudonymization or redaction: the comparison table

Which mistakes should you avoid?

1. Believing a pseudonymized copy is anonymous. It isn't for you, and it may not be for the recipient if the text keeps details that point to someone. See re-identification risk.
2. Sending a third party a copy meant for an AI. It contains labels and sometimes a return reference: for a third party, use a properly redacted document in its original layout.
3. Redacting what you will send to the AI. You lose who-is-who and the ability to put the names back into the answer.
4. Forgetting metadata. Author, comments, tracked changes in Word, PDF properties: see remove PDF metadata.
5. Skipping review. No automatic detection is exhaustive, whichever technique you choose.

The two techniques are often combined on the same file: pseudonymize to prepare a memo with the AI, restore the real names, then redact the final version before sending it to the other side or publishing it.

What does AnonymFiles do in each mode?

From the home screen, the app asks what you want to do: prepare documents for an AI, redact a document to send or redact a text to paste. Detection and side-by-side review are the same; the export is what changes.

In both cases, each file is reread before release: if an original value is still there (text, invisible layer, metadata), the export is cancelled. Exported files carry neither the software's name nor its logo. The local AI connector follows the same split: the "caviarder_document" tool writes a final copy without keeping any mapping, while "pseudonymiser_document" keeps the encrypted mapping for restoring; see the MCP anonymization connector.

Everything happens on the computer, with no account and no telemetry: PDFs (scans included, through local OCR), Word, emails, Excel, PowerPoint, images and text, in an interface available in English and French. Pricing: €290 excl. VAT per seat per year, 14-day trial (pricing). For local authorities and public bodies: AnonymFiles for the public sector; the terms used here are defined in the glossary.