Organisations are increasingly looking for ways to use, analyse and share data while reducing privacy risks. Anonymisation and pseudonymisation are two important techniques for doing this, but they are not the same thing and the distinction has important implications under UK data protection law.
Personal data is defined under the Data Protection Act 2018 as “any information relating to an identified or identifiable living individual”. While properly anonymised data can fall outside the scope of UK data protection law, pseudonymised data remains personal data and must continue to be protected accordingly.
Understanding the difference between anonymised and pseudonymised data is therefore crucial for organisations seeking to handle information responsibly. It is also becoming increasingly important as advances in technology and artificial intelligence make it easier to combine datasets, infer information and potentially re-identify individuals.
In this blog, we explore what anonymisation and pseudonymisation mean, how they differ, where the boundaries can become blurred and the steps organisations can take to manage re-identification risks effectively.
What is anonymised data?
Recital 26 of the UK GDPR tells us that anonymised information is “information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.”
Although anonymised data falls outside the scope of personal data, the anonymisation process itself involves the processing of personal data and must be supported by an appropriate legal basis.
When is data considered truly anonymous?
The European Data Protection Board has set out a three-part identifiability test for assessing whether data is considered truly anonymous.
- No record isolation: The data does not contain a unique combination of attributes or values that could be used to distinguish or identify a specific individual.
- No linkage capability: The data cannot be linked, either directly or with a high degree of confidence, to another dataset relating to the same individual.
- No identifiable inference: The information does not enable any inference, either on its own or when combined with other reasonably available information, that could lead to the identification of an individual.
What is pseudonymised data?
Article 4(5) of the UK GDPR tells us that pseudonymised data is: “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”.
The most common types of pseudonymisation techniques are:
- Encryption – transforms data using a cryptographic algorithm that can be recovered using a decryption key
- Hashing – a one-way cryptographic process that transforms data into a unique hash value. While the original data cannot be reconstructed from the hash, hashing does not necessarily guarantee anonymity. Individuals may still be identifiable where the controller can link the hash to other data or where the underlying data is guessed, matched or exposed through a security breach or other attack.
- Tokenisation – the replacement of personal data with a randomly generated token that bears no meaningful relationship to the original data. The original data is stored separately and securely, with re-identification only possible through access to the underlying source data.
What is the difference between anonymised and pseudonymised data?
The key difference between anonymised and pseudonymised data is whether an individual can still be identified.
Where data has been effectively anonymised, an individual should no longer be identifiable using reasonably available means. As a result, truly anonymised data falls outside the scope of UK data protection law.
Pseudonymisation reduces the ability to directly identify an individual by replacing or separating identifying information. However, where additional information exists that could be used to reconnect the data to an individual, the information remains personal data and continues to be subject to data protection requirements.
This distinction is important. Removing names, email addresses or other obvious identifiers does not automatically make a dataset anonymous. Organisations must consider whether individuals could still be identified through the remaining information, other available datasets or the means reasonably available to those handling the data.
Can pseudonymised data be considered anonymous?
The Information Commissioner’s Office tells us that if you share pseudonymised data, but not the additional information, with another organisation, it may be anonymous information in their hands.
In practice, we regularly get the question around whether pseudonymised data could be considered anonymous to those without any access to the tools required to re-identify. The answer is a little more nuanced than a simple yes or no and is wholly based on the risks and circumstances.
The spectrum of identifiability is the idea of contextual variables in practice within the space between information directly relating to identified or identifiable people and truly anonymised data that will affect how we categorise information.
Considerations include:
- Advances in anonymisation techniques may alter what is considered effective anonymisation.
- Developments in identification methods or changes to technical controls may increase the risk of re-identification.
- Means of identifying an individual that were previously impractical may become technically feasible and cost-effective.
- Additional datasets or information that enable identification may become available.
- Changes in the processing environment, technology or availability of data may affect the level of protection provided to individuals.
As a result, data that is considered effectively anonymised today may not remain so in the future and regular review of anonymisation measures is therefore essential.
How does AI affect data anonymisation?
The risk of re-identification is becoming increasingly significant with the advancement of artificial intelligence. AI can enhance the ability to link datasets, identify patterns, infer identities and re-identify individuals from information that was previously considered anonymous or suitably pseudonymised.
This does not mean that anonymisation is ineffective, but it does reinforce the need for organisations to treat anonymisation as an ongoing risk-management process rather than a one-off technical exercise. Techniques and controls should be reviewed as technologies, datasets and reasonably available means of identification evolve.
Common anonymisation and pseudonymisation mistakes
Many organisations go wrong by treating these techniques as a technical task that needs no further attention without introducing an ongoing risk-management process to govern the continued effectiveness of these processes. Some missteps include:
- False anonymisation, where an individual remains identifiable in some capacity and the process is reversible.
- Misunderstanding the distinction between anonymisation and pseudonymisation, which can result in organisations treating pseudonymised data as anonymous. It is important to remember that pseudonymised data remains personal information and should be treated in such a way.
- Relying on weak pseudonymisation controls when storing the raw data, including poor key management, reversible tokens and unsalted hashes, which increase the risk of re-identification.
How to manage anonymised and pseudonymised data effectively
Pseudonymised data:
- Ensure any re-identification mechanisms are maintained separately from pseudonymised datasets and protected through strict access controls.
- Regularly assess and test re-identification risks, taking into account advances in technology and emerging threats.
- Maintain appropriate governance and documentation, including Data Protection Impact Assessments (DPIAs), Records of Processing Activities (RoPAs) and access logs for raw data sets.
- Review and update pseudonymisation techniques and controls regularly to align with current regulatory guidance, industry standards and best practice.
Anonymised data:
- Implement robust anonymisation techniques to minimise the risk of individuals being identified from the data.
- Map and understand data flows to assess whether different datasets could be combined or linked in a way that enables re-identification.
- Apply the “motivated intruder test” to determine whether a reasonably competent individual using publicly available information and tools could identify a person from the anonymised data.
- Consider all parties with potential re-identification capabilities including controllers, processors, third parties and malicious actors.
- Regularly review and test the effectiveness of anonymisation measures to ensure they remain appropriate as technologies and risks evolve.
- Adopt a risk-averse approach and maintain appropriate governance, even where anonymised data falls outside the scope of the UK GDPR.
How NormCyber can help
Anonymisation and pseudonymisation should not be treated as one-off technical exercises. As datasets, technologies and methods of re-identification evolve, organisations need to regularly assess whether their controls remain effective and whether information continues to be handled in line with data protection requirements.
NormCyber’s Data Protection Consultancy service helps organisations apply anonymisation and pseudonymisation techniques with confidence, embedding privacy, security, governance and compliance throughout the data lifecycle.
We support organisations with assessing privacy and re-identification risks, conducting DPIAs, selecting appropriate de-identification methods, managing data-sharing arrangements and establishing robust policies and controls.
If you need support reviewing how your organisation anonymises, pseudonymises or shares personal data, explore our Data Protection Services or speak to one of our data protection specialists.
