EU and UK

Pseudonymisation vs anonymisation: what GDPR and DPA 2018 say

Updated 2026-10-08

Replacing names with codes does not take data out of data protection law on either side of the Channel.

Pseudonymisation means the data can no longer be attributed to a specific person without additional information, provided that information is kept separately. Recital 26 adds that such data, which could be attributed to a person by using the additional information, should be considered information on an identifiable natural person.

The UK

Section 171 of the Data Protection Act 2018 defines de-identified personal data as data that can no longer be attributed, without more, to a specific data subject, and makes it an offence knowingly or recklessly to re-identify it without the controller's consent.

What that means for a licence

A pseudonymised dataset licensed to a buyer is, on these texts, still personal data. Whether the buyer may hold it is a question for both sides' counsel before anything is shared.

De-identifying data to license it?

How much data would be licensed?

When would you license it?

Which standard are you working to, and what is left to do? (optional)

Which systems or tools hold the records you are de-identifying?

How many people work at the company?

The company's annual revenue, in pounds or dollars

How many years of records do those systems hold?

What language are the records written in?

Is the company trading, closing or being sold?

Has a buyer already made an offer for the data?

Yes No

Country

Your role

Work email

Tick the box above to send your enquiry.

Find the standard before you redact

Two choices: the data and your method. The answer quotes the standard that governs it.

Talk to a specialist Check my data's standard

Questions, answered directly

Does keeping the key separately make pseudonymised data anonymous?

No. The GDPR text makes keeping the additional information separately part of the definition of pseudonymisation, and Recital 26 still treats the data as information on an identifiable person.

Sources

This site's own dataset, every figure quoted from its source and dated:

De-identification standards, what each requires: 6 de-identification and redaction standards were read for what they require removed or transformed, each answer quoted from the standard's own text, read 8 October 2026.

Talk to a specialist