# What is Anonymization? > Anonymization is processing data so the people it describes can no longer be identified by anyone using means reasonably likely to be used. Under GDPR and UK GDPR, truly anonymous data is no longer personal data. Pseudonymized data, where identities are only swapped for codes, still is. Source: https://sellmydata.com/glossary/anonymization/ Published: 2026-10-28 ## How regulators define it Under the EU GDPR, [Recital 26](https://gdpr-info.eu/recitals/no-26/) describes anonymous information as data that does not relate to an identified or identifiable person, and says data protection principles should not apply to it. Whether someone is identifiable depends on all the means reasonably likely to be used, such as singling out a person, by the data holder or by anyone else. The recital says to weigh the cost and time of identification, the technology available now and technological developments. The UK regulator, the ICO, takes a similar line: [UK GDPR does not apply to anonymised data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/), but a person can be identified from many distinguishing factors, not just a name, and [identifiability sits on a spectrum](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/). Its guidance, [published 28 March 2025](https://www.rpclegal.com/snapshots/data-protection/summer-2025/ico-publishes-new-guidance-on-anonymisation-and-pseudonymisation/), says the risk does not have to be reduced to zero and recommends a "motivated intruder" test ([Taylor Wessing](https://www.taylorwessing.com/en/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---new-ico-guidance-on-anonymisation-and-pseudonymisation)). In the EU, the European Data Protection Board adopted [draft Guidelines 02/2026 on 7 July 2026](https://privacymatters.dlapiper.com/2026/08/eu-edpb-publishes-draft-guidelines-on-anonymisation/), open for consultation [until 30 October 2026](https://www.edpb.europa.eu/news/edpb-sheds-light-on-anonymisation-and-web-scraping-for-generative-ai-and-adopts-final-version_en). According to [DataGuidance](https://www.dataguidance.com/news/eu-edpb-publishes-guidelines-anonymization-public), the draft sets three tests: no single person can be picked out, records can't be matched to other data, and facts about a person can't be deduced. It also says anonymised data should be reassessed periodically as technology changes. ## Anonymization vs. pseudonymization and de-identification Pseudonymization swaps identities for codes while the key exists somewhere. The ICO says [pseudonymised data is not anonymous](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/). In the US, the FTC said in July 2024 that [hashing or pseudonymising identifiers does not make data anonymous](https://privacymatters.dlapiper.com/2024/07/ftc-reiterates-that-hashed-and-pseudonymized-data-is-still-identifiable-data/). Terminology also shifts by country. California's CCPA uses "deidentified" rather than "anonymized", and [excludes deidentified and aggregate information from personal information](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140) when the business takes reasonable measures and meets other conditions. NIST notes that [some authors treat de-identification and anonymization as the same thing, while others reserve anonymization for de-identification that cannot be reversed](https://nvlpubs.nist.gov/nistpubs/ir/2015/nist.ir.8053.pdf). ## Why it is hard Removing names is rarely enough. A 2019 study in [Nature Communications](https://www.nature.com/articles/s41467-019-10933-3) found that 15 demographic attributes would render 99.98% of people in Massachusetts unique. NIST also describes a [trade-off](https://nvlpubs.nist.gov/nistpubs/ir/2015/nist.ir.8053.pdf): more aggressive techniques protect privacy better but leave less useful information in the dataset. ## Why it matters when you sell data Calling a dataset "anonymized" is a legal claim, and whether it holds depends on the jurisdiction, the data and what a recipient could realistically do with it. This is general information, not legal advice; ask your counsel before relying on the label. It also helps to be precise about what a provider actually does. SellMyData, for example, describes its process as [de-identification](https://sellmydata.com/de-identification/): names, contact details and identifiers are replaced with consistent placeholders, and that page sets out the limits of the approach. ## Frequently asked questions ### Is anonymized data the same as de-identified data? Not always. NIST notes that some authors use the terms interchangeably, while others treat anonymization as a specific kind of de-identification that cannot be reversed. US laws such as California's CCPA use "deidentified" with their own legal conditions. ### Is pseudonymized data anonymous? No. The UK ICO says pseudonymisation is effectively a security measure and does not change the data's status as personal data. ### Does hashing an email address make data anonymous? According to the FTC's July 2024 statement, no. Hashing turns a value into a fixed code, and the same input always gives the same code, so the FTC says companies should not treat hashed personal information as anonymized. ### Does GDPR apply to anonymized data? GDPR Recital 26 says the Regulation does not concern anonymous information. The bar is high, though: no one should be able to identify a person using any means reasonably likely to be used. Whether a specific dataset meets it is a question for your counsel. ## Sources - [Recital 26: Not Applicable to Anonymous Data](https://gdpr-info.eu/recitals/no-26/) - [What is personal data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/what-is-personal-data/what-is-personal-data/) - [How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/) - [ICO publishes new guidance on anonymisation and pseudonymisation](https://www.rpclegal.com/snapshots/data-protection/summer-2025/ico-publishes-new-guidance-on-anonymisation-and-pseudonymisation/) - [New ICO guidance on anonymisation and pseudonymisation](https://www.taylorwessing.com/en/global-data-hub/2025/spotlight-on-the-uk-data-landscape/gdh---new-ico-guidance-on-anonymisation-and-pseudonymisation) - [EU: EDPB publishes draft guidelines on anonymisation](https://privacymatters.dlapiper.com/2026/08/eu-edpb-publishes-draft-guidelines-on-anonymisation/) - [EDPB sheds light on anonymisation and web scraping for generative AI](https://www.edpb.europa.eu/news/edpb-sheds-light-on-anonymisation-and-web-scraping-for-generative-ai-and-adopts-final-version_en) - [EU: EDPB publishes guidelines on anonymisation for public consultation](https://www.dataguidance.com/news/eu-edpb-publishes-guidelines-anonymization-public) - [NIST IR 8053: De-Identification of Personal Information](https://nvlpubs.nist.gov/nistpubs/ir/2015/nist.ir.8053.pdf) - [California Civil Code Section 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.140) - [FTC reiterates that hashed and pseudonymized data is still identifiable data](https://privacymatters.dlapiper.com/2024/07/ftc-reiterates-that-hashed-and-pseudonymized-data-is-still-identifiable-data/) - [Estimating the success of re-identifications in incomplete datasets using generative models](https://www.nature.com/articles/s41467-019-10933-3)