Module 2, Anonymous vs pseudonymous data
Anonymous data is rendered unidentifiable and is NOT protected by the GDPR, but true anonymisation is hard. Pseudonymous data is NOT fully anonymous - identifying aspects are detached but the data can be re-identified with separately held information, so it remains personal data subject to the GDPR. Pseudonymisation is a security measure that reduces risk and is a factor in assessing risk for breaches and transfers.
| Anonymous data | Pseudonymous data | |
|---|---|---|
| Re-identifiable? | No - cannot be traced back | Yes - with additional information kept separately |
| GDPR applies? | NOT protected by the GDPR | Remains personal data subject to the GDPR |
| Nature | Rendered unidentifiable | A security measure that reduces risk |
| Examples | Aggregated statistics with no identifiers; de-identified health data | "Customer A" coded data; encrypted records with the key stored separately; tokenised card numbers |
Pseudonymous data can be re-identified with additional information and so stays under the GDPR; properly anonymous data cannot be traced back and falls outside the GDPR. True anonymisation is hard - data can become identifiable by a small margin.
The fact that data is pseudonymous is a factor in assessing risk (e.g. for breach notification or international transfers). Masking / data obfuscation manipulates real data to reduce risk while preserving desired properties.
Key terms - quick answers
What is “anonymous data”?
What is “pseudonymous data”?
What is “pseudonymisation”?
What is “masking”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.