Anonymization glossary: key terms in English, French and German

This glossary gives about 30 data protection terms in English, French and German, grouped by theme. For every term in the GDPR, it uses the official wording of each language version. Keep it open when a French colleague writes occultation, a German one writes Schwärzung, and you wonder whether they mean redaction.

What are the core data protection terms in three languages?

Each table starts with English, then French and German. Terms marked as not defined in the GDPR come from guidance or standards. This glossary spells anonymization with a z, but the regulation's English text writes pseudonymisation with an s.

The GDPR defines pseudonymization in Article 4(5) but never defines anonymization. Recital 26 only says that anonymous information, informations anonymes in French and anonyme Informationen in German, falls outside the rules. The German federal authority BfDI adds, in its 2020 position paper, that pseudonymized data stays personal data.

What are the main techniques for hiding data called?

These words describe what you do to the data, not the legal result. The last six rows are based on the Article 29 Working Party's Opinion 05/2014, available in all three languages. It does not list redaction or masking as techniques, so their words come from authorities' practice.

Which words describe what hides inside a document file?

These terms have no official wording in the GDPR. They come from everyday use and from guidance by authorities and software makers. The French and German words below are the usual ones.

Microsoft's Document Inspector looks for comments, tracked-change marks, document properties with personal information and hidden text. Lower Saxony's data protection authority says to check metadata such as the author. The ICO warns that pasting a PDF with black rectangles into a text editor can reveal the covered text. Its guidance is dated 31 July 2025.

What are the GDPR roles and procedures called in French and German?

This is where the official wording matters most. Every term below is copied from the matching language version of the regulation. The article numbers help you find the full text.

In the UK, people say subject access request. The ICO uses that phrase, but Article 15 is titled right of access by the data subject. The BfDI writes Auskunftsersuchen for the request itself, and the CNIL speaks of a demande de droit d'accès. In formal writing, use the title of the article.

Which terms look alike but mean different things?

These are the traps that cause misunderstandings between teams. Each one rests on an authority's own wording.

• Sensitive data. The CNIL uses donnée sensible for the special categories of Article 9, such as health, religion or union membership. Bank details and addresses are not on that list, even if they feel sensitive. The regulation itself says special categories.
• Anonymization. It is often used for any masking. Yet the CNIL writes that anonymisation must not be confused with pseudonymisation, and the BfDI warns against assuming too quickly that anonymization is sufficient.
• Redaction. One gesture, several words. The French Ministry of Justice says occultation for names removed from published court decisions. The CNIL says masquer for third parties in an access reply. The BfDI says schwärzen. NIST notes that redaction sometimes means plain removal of information in government. Lower Saxony's authority calls it a technical and organisational measure under Article 32.
• Hashing. The word sounds irreversible, so people call hashed data anonymous. The Working Party warns that when the possible inputs are known, such as national ID numbers, you can hash them all and compare. Hashing is a pseudonymization technique.
• Controller and processor. In daily speech, a responsable or Verantwortlicher is anyone in charge, and a sous-traitant is any subcontractor. In the GDPR, they are roles defined in Article 4.

How do you use these words in a real document workflow?

Name the result, not only the gesture. Write redacted when you removed passages. Write pseudonymized when labels can be linked back. Write anonymized only when the reasonable means test of Recital 26 is met. One short vocabulary line in your procedure saves long email threads between teams.

1. Decide which legal result you need: anonymous, pseudonymized or simply redacted.
2. Use the official term of the recipient's language for roles and rights, such as Verantwortlicher or responsable du traitement.
3. Check the hidden parts: metadata, annotations, tracked changes and the text layer.
4. Mask indirect identifiers too, such as a rare job title or a date, not only names.
5. Keep the original, and treat the masked copy as personal data if labels can be linked back.
6. Ask your data protection officer, or the authority of your country, when one word decides a legal duty.

ONYRI Sanitize, a tool that runs in your browser, uses two of these terms. Its Black marker mode is redaction with a flattened export, so masked text is removed, not covered. Its Token mode, on the Pro plan, replaces each value with a label such as [NAME1]. That is pseudonymization, so the document stays personal data. Detection is not exhaustive, so review the preview.

This glossary is information, not legal advice. A contract or a national law can use other words, and a lawyer or your data protection officer can confirm which term applies. The wording was checked in October 2026.

Frequently asked questions

Sources & references