Whether data is anonymous or merely pseudonymised decides whether data protection law applies at all. The distinction is often underestimated in practice, for test data, analytics or training AI models.
Anonymisation
Data is anonymous if a person can no longer be identified with means reasonably likely to be used. That is harder than it sounds: removing name and address is often not enough, because combinations such as postcode, year of birth and occupation make a person recognisable again. Genuine anonymisation uses aggregation, generalisation or removal of rare attributes and is tested before being relied upon.
Pseudonymisation
The GDPR defines pseudonymisation as processing after which data can no longer be attributed to a person without additional information, provided that information is kept separately and protected. A typical example is replacing a name with an ID number. For the controller holding the key, the data remains personal data. Pseudonymisation is nonetheless a recognised safeguard and lowers risk, for example in data breaches.
The recipient’s perspective
In September 2025, in the case of the European Data Protection Supervisor against the Single Resolution Board, the Court of Justice of the EU confirmed that pseudonymised data may not be personal data for a recipient who cannot identify the persons with means reasonably likely to be used. For the transmitting party it remains personal data. The Swiss FADP likewise follows a relative approach based on the capabilities of the respective holder.
Practice
For test and development environments, pseudonymised or synthetic data is usually a better choice than production copies. For statistics and reports, aggregation often suffices. Anyone anonymising rather than deleting data after the retention period must be able to prove the anonymisation, see deletion concept.