In projects you often hear: the data is anonymised anyway. Often it is not. Usually the data is pseudonymised, and legally that is something else. The confusion leads to overlooked obligations, for example in analytics, test data or training AI models.
Pseudonymisation
The GDPR defines pseudonymisation as processing personal data so that it can no longer be attributed to a specific person without additional information, provided that information is kept separately and protected by technical and organisational measures. A typical example is replacing names with identifiers whose mapping table is kept elsewhere. For the controller holding the table, the data remains personal data.
Anonymisation
Data is anonymous when the person is not or no longer identifiable, taking into account all means reasonably likely to be used. Data protection law then no longer applies. The bar is high: a dataset without names but with date of birth, postcode and sex can often identify a person uniquely. Genuine anonymisation therefore needs aggregation, generalisation or techniques that make individuals indistinguishable.
The recipient’s perspective
Whether data is personal for a recipient can depend on whether it realistically has access to the re-identification information. The Court of Justice of the EU confirmed this relative approach in September 2025 (case C-413/23 P). For the controller that knows the mapping nothing changes; it remains bound, for example to inform data subjects. The Swiss FADP takes a comparable approach based on identifiability.
Why pseudonymisation is still valuable
Pseudonymisation is no exemption, but it is a strong safeguard. It lowers risk in a data breach, eases changes of purpose for statistics and research and is a classic element of privacy by design. In SaaS products it suits analytics, test environments and support exports.
In AI projects
For RAG systems, fine-tuning or analyses with LLMs the question is particularly sharp. A prompt with pseudonymised customer data sent to an external provider is processing of personal data by a processor, with a contract and possibly a disclosure abroad. Anonymising before sending is possible but harder than it sounds, because free text often identifies people indirectly.