Anonymization, pseudonymization, redaction: what is the difference?

Anonymized data can no longer be linked to a person by anyone using reasonable means, so the GDPR stops applying. Pseudonymized data can be linked back with extra information, such as a key or the original file, so it stays personal data for whoever holds that information. Redaction is not a legal category: it means masking passages in a document, and the result can be either.

What does the GDPR say about anonymization and pseudonymization?

The GDPR defines only pseudonymization. Under Article 4(5), it means processing personal data so that it can no longer be attributed to a specific person without additional information, kept separately and protected by technical and organisational measures.

Anonymization is not defined in the articles. Recital 26 draws the line: pseudonymized data that could be attributed to a person with additional information concerns an identifiable person. You weigh all the means reasonably likely to be used, by the controller or by anyone else, taking into account cost, time and available technology.

The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. (GDPR, Recital 26)

So truly anonymous information falls outside the GDPR, and pseudonymized data does not. In the UK, the ICO agrees: pseudonymisation reduces risk and improves security, but it does not take personal data outside the law. As of September 2026, the ICO notes that this guidance is under review after the Data (Use and Access) Act.

Why is replacing a name with a label pseudonymization?

Take a complaint letter about an employee, Jane Example. You replace her name everywhere with [NAME1], her email with [EMAIL1] and a colleague's name with [NAME2]. The text stays readable, and you can still follow who did what. That is the point of consistent labels, and it is exactly why this is pseudonymization.

The Article 29 Working Party, the EDPB's predecessor, explains why in Opinion 05/2014. Pseudonymization replaces one attribute with another: a useful security measure, but not a method of anonymization. The opinion tests each technique against three risks.

• Singling out: can you isolate what concerns one person? With [NAME1], yes: every sentence about her carries the same label.
• Linkability: can you link records about the same person, here or in another file? A shared label does exactly that.
• Inference: can you deduce something about her with significant probability? Her job, her team and the incident date may be enough.

On 4 September 2025, in EDPS v SRB (C-413/23 P), the EU Court of Justice added a nuance. The case concerned EU bodies, but the Court reads the concept of personal data as in the GDPR. Pseudonymized data is not personal data in all cases and for every person. For a recipient with no reasonable means of re-identification, it may not be. For the party holding the additional information, such as you with your original, it stays personal.

What is redaction, and where does it fit?

Redaction is an operation on one document. You mask passages in it: a name, an account number, a signature, a face in a photo. The classic form is the black bar. The word describes what you do to the page, not the legal status of what is left.

That status depends on the result. Black out the names in a contract but leave the address, job title and dates, and the people usually stay identifiable. Replacing values with labels is also redaction, and it produces a pseudonymized document.

Which one do you need for your document?

1. 1List who will see the document and what they must read.
2. 2Mark direct identifiers: names, emails, phone numbers, addresses, ID and account numbers, signatures, photos.
3. 3Mark indirect identifiers: job titles, rare dates, places, small teams, unusual facts.
4. 4Use black bars if the reader does not need the content, and labels if they must follow who is who. For a public file, aim for anonymization.
5. 5Export a flattened copy without metadata, paste its text into an editor and search for a masked name.
6. 6Reread it as a stranger would. If you can tell who it is, mask more or treat the file as personal data.

I removed the names. Is my document anonymous?

Almost never. The ICO says a person can be identifiable even if you do not know their name, and that simply removing direct identifiers is not enough. Picture a disciplinary report without the name Jane Example. It still says: the only night-shift pharmacist at the Springfield site, hired in March 2019. Any colleague knows who it is.

The ICO suggests the motivated intruder test: could a reasonably competent person, using the internet, libraries and public documents, identify someone? If so, the file is not anonymous. The ICO also warns of the mosaic or jigsaw effect: details that seem harmless alone can identify someone once combined.

What should you do in practice?

Use the right word: say masked, redacted or pseudonymized, and say anonymized only when it truly is. Then keep treating the file as personal data: few recipients, a secure channel, deletion when the job is done. Always work on a copy.

Dedicated redaction software, a PDF editor's redaction feature or a browser-based tool can do the masking. ONYRI Sanitize is a browser-based tool: detection and masking run in your browser, and the file is not uploaded. It offers black bars, or labels such as [NAME1] on the Pro plan, and always exports a flattened PDF or image. Detection is not exhaustive, so review each item before downloading. Masking reduces exposure. It does not, by itself, make a document anonymous.