Anonymisation and pseudonymisation

Pseudonymisation (Article 4(5) GDPR) replaces the data that identifies a person (name, ID number) with a code, keeping separately the "key" that allows re-identification. It reduces risk, but the data is still personal and the GDPR still applies.

Anonymisation goes further: it transforms the data so that nobody can be identified any more, either directly or by combining it with other information, by means reasonably likely to be used. If truly achieved, the GDPR no longer applies. But it is hard: removing the name is not enough if date of birth, postcode and occupation remain.

In AI the difference is key: training a model on pseudonymised data is still processing personal data. Before declaring a dataset "anonymous", assess and document the re-identification risk.