GDPR: redaction, pseudonymisation and anonymisation — which and when?

These three terms confuse people — and GDPR treats them very differently. Here's what sets them apart and when each one applies.

GDPR uses "pseudonymisation" and "anonymisation" as fundamentally distinct terms. Redaction is a technique used to achieve one or the other. So what's the actual difference?

Anonymisation

Data is made irreversibly unidentifiable — the person can no longer be identified, even with additional information. Once data is truly anonymous, it falls outside the scope of GDPR.

The test: no one could reasonably re-identify the person, even with considerable effort or access to additional data sources.

Pseudonymisation

Data is made less identifying. Someone who holds the translation table or key can still re-identify the individual. Pseudonymous data remains subject to GDPR, but carries reduced processing risk.

Examples

• "Kees Janssen, 123 Main Street" → "K.J., [redacted]": pseudonymous (a colleague may still recognise the person).
• Full name and all metadata removed, with no way to link back: anonymous.
• Statistically aggregated data (e.g. average team age): anonymous.
• Hashed email address using a known hash function: pseudonymous (the same hash allows comparison and potential re-identification).

Why does it matter?

• With anonymisation: no further GDPR obligations. You may freely share, retain, and process the data.
• With pseudonymisation: still under GDPR, but with reduced risk. Information obligations and data-subject rights still apply.
• Full identification (no redaction): full GDPR applies.

Practical guidance

• Documents intended for public release: anonymise (genuine redaction + metadata removal + no hash key).
• Internal processing where "what if we spot something suspicious" is a real scenario: pseudonymise so that re-identification remains possible.
• Research and statistics: anonymisation is usually sufficient and resolves many governance questions upfront.

See also: redaction guide, GDPR overview.