These two terms are used interchangeably in casual conversation, but legally — under GDPR, CCPA, and HIPAA — they are near-opposites with dramatically different compliance implications.
Pseudonymization (Reversible)
Pseudonymization replaces a direct identifier (Name: "Alice") with a pseudonym (ID: User_99). The critical detail: somewhere, a mapping table (also called a "key") exists that links User_99 back to "Alice." The data has been obscured, but not destroyed.
- Legal Status under GDPR: Pseudonymized data is still Personal Data (Recital 26). If the key is stolen or subpoenaed, the data is fully exposed. The data controller is still subject to all GDPR obligations.
- Common implementations: Symmetric encryption (AES-256), HMAC hashing with a secret key, or a dedicated lookup table stored in a separate, access-controlled database.
- When to use it: When you need to re-identify individuals later — for example, to send a user their account deletion confirmation, or to join datasets for a specific authorized purpose.
Anonymization (Irreversible)
True anonymization destroys the link between the data and the individual so thoroughly that re-identification is impossible — even by the data owner, even with additional datasets, even in the future.
- Legal Status under GDPR: Properly anonymized data is not Personal Data (Recital 26). It falls outside GDPR's scope entirely. You can share it publicly, sell it, or use it for any purpose.
- The catch: True anonymization is extraordinarily difficult to achieve in practice. Most datasets that organizations call "anonymized" are actually pseudonymized or merely de-identified, and remain vulnerable to re-identification attacks (as the NYC Taxi dataset and Netflix Prize dataset famously demonstrated).
- Common implementations: Aggregation ("Average age of users is 34"), Differential Privacy (covered below), or k-anonymity with sufficient generalization.
The practical implication: if your legal team says "just anonymize it and you're fine," your engineering team needs to verify that the anonymization is mathematically rigorous — not just that the Name column was deleted.