What is anonymisation?
Anonymisation is processing data so that no person can be identified any longer, directly or indirectly, with no way back.
Data that is truly anonymous falls outside the GDPR. That makes anonymisation tempting, but it is harder than it sounds.
Removing the name is rarely enough. Age, job, town and dates together can point to a person. Free text is especially hard, because details often sit in the middle of sentences.
If there is a reasonable possibility of identifying someone, the data still counts as personal data. At best it is then pseudonymised.
How it works
Common methods are to group data together, to make it coarser, such as a year instead of a date or a region instead of an address, or to add noise. The assessment covers three risks. That someone can be singled out, that records can be linked with other sources and that something can be inferred about a person.
A table with age, postcode and diagnosis can single out an individual patient in a small town. With age bands and regions instead, the risk drops considerably.
Why it matters
Anonymous data can be used more freely, for statistics, research and development. But if the anonymisation fails, GDPR applies in full, often without anyone realising. A mistake can therefore lead to processing without a legal basis.
What to keep in mind
The risk changes over time. New data sources and better tools can make it possible to identify people in data that used to be anonymous. Repeat the assessment.
AI models can retain parts of their training data. The European Data Protection Board has said a model trained on personal data cannot always be considered anonymous.
What it means for you
Do not assume data is anonymous just because the names are removed. Make an assessment or let the data stay in your environment.
Common questions
When is data truly anonymous?
When no one can be identified by means reasonably likely to be used, even if the data is combined with other information.
Is removing names and ID numbers enough?
Rarely. A combination of age, town, job or dates can be enough to single someone out.
Does GDPR apply to anonymous data?
Truly anonymous data is not covered. The act of anonymising, however, is processing of personal data and must comply with GDPR.
Sources: GDPR, Recital 26, on EUR-Lex
Related terms
Read more
All terms Updated