Anonymization vs Pseudonymization vs Encryption
Three fundamental data protection techniques, each with distinct legal status, reversibility, and use cases. Understanding the differences is critical for GDPR compliance.
Three Approaches to Data Protection
Each technique serves a different purpose. The right choice depends on whether you need to share data, process it internally, or protect it in storage.
Anonymization
Irreversible removal of identifying information. Once anonymized, data cannot be linked back to any individual. The original values are permanently destroyed.
- GDPR Status: Outside scope — not personal data
- Reversible: No — permanent transformation
- Best for: Analytics, research, data sharing
Pseudonymization
Reversible substitution of identifiers with tokens or pseudonyms. A separate key or mapping table allows re-identification when authorized.
- GDPR Status: Personal data (Art. 4(5))
- Reversible: Yes — with key or mapping
- Best for: Internal processing, backups, testing
Encryption
Mathematical transformation of data into ciphertext using a cryptographic key. Decryption restores the original data exactly as it was.
- GDPR Status: Personal data — reversible with key
- Reversible: Yes — with decryption key
- Best for: Data at rest, data in transit, access control
Side-by-Side Analysis
Ten dimensions that matter when choosing a data protection technique. Each method excels in different areas.
| Dimension | Anonymization | Pseudonymization | Encryption |
|---|---|---|---|
| Definition | Irreversible removal or transformation of personal identifiers | Reversible substitution of identifiers with tokens or pseudonyms | Mathematical transformation of data into ciphertext using a key |
| Reversibility | No | Yes — with key | Yes — with key |
| GDPR Status | Outside scope | Personal data (Art. 4(5)) | Personal data |
| Data Utility | Reduced | Preserved | Preserved |
| Processing Speed | Fast | Fast | Medium |
| Key Required | No | Yes | Yes |
| Re-identification Risk | Eliminated | Managed | Managed |
| Typical Methods | Replace, redact, generalize | Tokenize, hash, mask | AES-256 (symmetric encryption), RSA (asymmetric encryption), TLS (transport security) |
| Use Cases | Sharing, analytics, ML training | Testing, development, backup | Storage, transmission, access |
| Implementation Complexity | Medium | Medium | High |
Note: GDPR Recital 26 clarifies that data rendered truly anonymous (not reasonably linkable to a natural person) falls outside the regulation’s scope. Pseudonymization is explicitly defined in Article 4(5) as a processing technique, not an exemption.
Anonymization — Irreversible by Design
What It Is
Anonymization permanently removes or transforms personal identifiers so that the data subject can no longer be identified, directly or indirectly, by any means reasonably likely to be used. The original data is destroyed — there is no key, no mapping table, no way back.
This irreversibility is precisely what gives anonymization its legal advantage: truly anonymized data falls outside the scope of GDPR entirely, meaning it can be shared, published, and processed without the constraints that apply to personal data.
How It Works
The detection engine identifies all PII entities in the text, then applies a destructive transformation. The method depends on the entity type and the desired output format:
- Replace — Substitute with a generic label: “John Smith” becomes “PERSON_1”
- Redact — Remove entirely: “4532-8821-1234-5678” becomes “[REDACTED]”
- Generalize — Reduce precision: “15 March 1987” becomes “1987”
Real-World Examples
The patient John Smith (DOB: 15/03/1987) was treated at Berlin Charité. Contact: john.smith@email.de
The patient PERSON_1 (DOB: 1987) was treated at ORGANIZATION_1. Contact: [REDACTED]
The patient **** (DOB: ****) was treated at ****. Contact: ****
Our 5 Methods
anonymize.solutions supports Replace, Redact, Mask, Hash, Encrypt. Replace and Redact are irreversible (anonymization). Mask and Hash are irreversible too; only Encrypt is reversible, with the correct key.
Pseudonymization — Reversible with Authorization
What It Is
Pseudonymization replaces identifying information with artificial identifiers (pseudonyms or tokens). A separate, securely stored key or mapping table allows authorized parties to reverse the transformation and recover the original data.
GDPR Article 4(5): “Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately.”
How Tokenization Works
Each detected entity is replaced with a unique token. A secure mapping table records the relationship between the token and the original value. When re-identification is needed, the mapping table is consulted to restore the original data.
When Organizations Need It
Pseudonymization is the right choice when you need to process personal data but want to limit exposure and comply with GDPR’s data minimization principle.
- Testing with Realistic Data — Development teams need data that behaves like production data but doesn’t expose real identities. Pseudonymized test datasets preserve format, length, and relationships.
- Internal Analytics — Business intelligence teams can analyze patterns across pseudonymized datasets without accessing real personal data, reducing risk while maintaining analytical value.
- Cross-Department Sharing — Share datasets between departments (e.g., marketing receives customer behavior data from support) without exposing personal identifiers to unauthorized teams.
- Backup & Disaster Recovery — Pseudonymize backups so that a breach of backup storage doesn’t expose real personal data. Restore with the key when needed.
- Research & Clinical Trials — Medical researchers can analyze patient data without knowing patient identities, with re-identification possible for follow-up when clinically necessary.
GDPR Benefit
While pseudonymized data is still personal data, GDPR explicitly recognizes pseudonymization as a security measure (Article 32) and provides specific provisions that make it easier to process pseudonymized data for research and statistical purposes (Article 89).
Encryption — Mathematical Access Control
What It Is
Encryption transforms data into unintelligible ciphertext using a mathematical algorithm and a cryptographic key. Only someone with the correct decryption key can restore the original data. Without the key, the encrypted data is computationally infeasible to read.
Symmetric vs Asymmetric
Symmetric (AES-256)
Same key encrypts and decrypts. Fast, efficient, ideal for data at rest and bulk processing. This is what the anonym.legal desktop app uses for its local vault.
Asymmetric (RSA)
Public key encrypts, private key decrypts. Slower, but enables secure key exchange. Used for TLS/HTTPS and digital signatures.
When to Use Encryption
- Data at Rest — Protect stored data (databases, file systems, backups) against unauthorized access
- Data in Transit — Secure data moving between systems (TLS/HTTPS, VPN, encrypted API calls)
- Access Control — Ensure only key holders can read specific data fields or documents
Encryption — what each product uses
The Encrypt protection method in anonym.legal uses AES in CBC mode with PKCS7 padding, as provided by Microsoft Presidio. It is reversible for whoever holds the key, and the key is sent to the service with the request, so the hosted service reads the text while it processes it. The desktop vault and stored keys are protected with AES-256-GCM, which authenticates as well as encrypts, under a key derived from your password with Argon2id.
What Zero-Knowledge covers
In anonym.legal, only this: custom patterns you store are encrypted in your browser; the server keeps only ciphertext. Encryption keys are derived on your device with Argon2id. The sign-in is not zero-knowledge, and the term does not describe document processing, which happens on our servers in Germany. In anonym.plus, the text never leaves your machine at all.
Which Method Should I Use?
Start with your use case. The right method depends on what you need to do with the data after protection.
“I need to share data externally”
When data leaves your control — shared with partners, published as open data, or used for third-party analytics — review the purpose, legal basis, recipient and re-identification risk. Genuine anonymization takes the data out of GDPR’s scope if it is actually achieved; properly governed transfers of personal or pseudonymized data (legal basis, contract, safeguards) can also be lawful.
Irreversible. If the data is truly anonymous, the recipient has no GDPR obligations for it.
“I need to process data internally”
When data stays within your organization — testing, development, internal analytics, cross-department sharing — pseudonymization maintains utility while reducing risk.
Reversible. Maintain data utility. Re-identify when authorized.
“I need to store or transmit data securely”
When data needs to be protected against unauthorized access — at rest in databases, in transit over networks, or in backup storage — encryption is the standard.
Key-based access control. Full data fidelity. Industry standard.
How anonymize.solutions Supports All Three
One platform, five protection methods, all three techniques. Choose the right method for each entity type, or let compliance presets decide automatically.
- Replace & Redact (Anonymization) — Irreversible transformation. Names become PERSON_1, credit cards become [REDACTED]. No key management required. Ideal for external sharing, analytics, and AI training data.
- Mask & Hash — Irreversible. Mask overwrites part of a value (e.g. ****1234); Hash turns it into a SHA-256 or SHA-512 digest, so the same value stays recognisable across records without being recoverable.
- Encrypt (Encryption) — AES, the only reversible method: reversible for whoever holds the key. In anonym.legal the key travels with the request to the service.
- Compliance Presets Auto-Select the Right Method — Compliance presets (e.g., GDPR) automatically assign the appropriate method based on entity type and regulatory requirements. No manual configuration needed.
- Encrypted Local Vault in the anonym.legal Desktop App — The vault stays on your device, encrypted with AES-256-GCM under a key derived from your password with Argon2id, so its contents are unreadable without that password. The document text itself goes to the anonym.legal service for analysis; only with anonym.plus does the text stay entirely on your machine.
Per-Entity Method Selection
Different entity types within the same document can use different methods. Anonymize names (Replace), mask email addresses (Mask), and encrypt medical record numbers (Encrypt) — all in a single processing pass.
267 Entity Types, 48 Languages
Our Hybrid detection engine (NLP + Pattern) identifies 267 entity types across 48 languages. Accuracy depends on language, entity type and input, so measure it on your own data. Every entity detected can be assigned any of the five protection methods independently.
Frequently Asked Questions
Yes. GDPR Article 4(5) explicitly defines pseudonymization as processing personal data such that it can no longer be attributed to a specific data subject without additional information. Because re-identification is possible with the key or mapping table, pseudonymized data remains personal data and is fully subject to GDPR obligations — including lawful basis, data subject rights, and breach notification. However, GDPR does recognize pseudonymization as a valuable security measure and provides specific accommodations for pseudonymized data in research contexts (Article 89).
No. By definition, anonymization is irreversible. Once data is truly anonymized, there is no key, mapping table, or algorithm that can recover the original values. This is what distinguishes anonymization from pseudonymization and encryption, and why anonymized data falls outside the scope of GDPR entirely. If a method claims to be “anonymization” but can be reversed, it is pseudonymization, not anonymization.
Anonymization is the recommended method for AI training data. Training datasets are shared broadly, ingested into model weights, and cannot be reliably deleted after training. Irreversible anonymization eliminates the risk of personal data leaking through model outputs. Pseudonymization is insufficient because the reversible tokens could theoretically be re-identified. Encryption is impractical because encrypted data cannot be used for training without first decrypting it.
No. Encryption is reversible with the correct key, which means the encrypted data can be linked back to an identifiable person. Under GDPR, encrypted data is still considered personal data. However, encryption is explicitly recognized as an appropriate technical measure under Article 32 (security of processing) and can significantly reduce the impact of data breaches — in some cases, encrypted data breaches may not require notification under Article 34.
Replace and Redact are the fastest methods because they perform simple string substitution or removal without any cryptographic operations or key management overhead. They are ideal for high-throughput pipelines where speed matters and reversibility is not required. Hash adds minimal overhead (a single hash computation per entity). Encrypt adds a cryptographic operation per entity (AES-CBC in anonym.legal) and is the only reversible method.
Yes. anonymize.solutions supports per-entity method selection, meaning you can anonymize names (Replace), redact credit card numbers (Redact), mask email addresses (Mask), and encrypt medical record numbers (Encrypt) — all within the same document and in a single processing pass. Compliance presets (e.g., GDPR) automatically assign the appropriate method based on entity type and regulatory requirements.
Does this apply to your organisation?
The guide is general; your obligation is not. Tell us the sector and where the data is allowed to go, and we will tell you what applies.
Try Both Anonymization Methods
Test irreversible anonymization vs. reversible pseudonymization on our platforms:
Hosted — anonym.legal
Our servers in Germany. 267 entity types, 48 languages. Free tier, then from €3 a month.
Open anonym.legal ↗On your machine — anonym.plus
Desktop client, the text never leaves the computer. 317 own pattern recognisers. Free for one machine, then a one-time licence from €149.
Open anonym.plus ↗