De-identification vs Anonymization: What's the Difference?

Why the words matter

When you share data with a partner, the legal obligations that follow often depend on whether the data still counts as personal data. If it does, privacy laws continue to apply to it. If it has been made truly anonymous, many of those obligations fall away. The terms used to describe the process therefore have real consequences.

Unfortunately, the terms are not used consistently. Different laws, industries and companies use them in different ways. The safest approach is to understand the underlying ideas and then check how the specific law that applies to you defines them.

De-identification: the general process

De-identification is a broad term for removing or altering information that identifies individuals. It covers a range of techniques, from deleting names to replacing them with substitutes to generalising dates and locations. On its own, the word does not say how complete the result is.

In the United States, the term has a specific meaning in healthcare. Under the HIPAA Privacy Rule, health information is considered de-identified if it meets one of two methods: Safe Harbor, which requires removing 18 listed types of identifiers and having no actual knowledge that the remaining information could identify someone, or Expert Determination, where a qualified expert concludes that the risk of re-identification is very small. Data that meets either standard is no longer protected health information under HIPAA.

Pseudonymization: identifiers swapped, key kept

Pseudonymization replaces identifiers with codes or substitutes, but the original identities can be restored using additional information that is kept separately, such as a lookup table. It is useful for security and for linking records, but it is reversible by whoever holds the key.

Under the EU's GDPR, pseudonymized data is still personal data. Recital 26 makes this explicit: information that could be attributed to a person through the use of additional information should be treated as information about an identifiable person. Pseudonymization reduces risk and is encouraged as a safeguard, but it does not take data outside the scope of the law.

Anonymization: no reasonable path back

Anonymization means the data can no longer be linked to an individual, taking into account all the means reasonably likely to be used to do so. GDPR Recital 26 states that its principles do not apply to anonymous information. The test considers factors such as cost, time and available technology, so it is about realistic risk rather than theoretical possibility.

This is a high bar. Removing names may not be enough if a combination of other details still points to one person. Free text, rare events, small populations and precise dates or locations all raise risk. Anonymization is also something that needs to hold up over time as other data becomes available.

• De-identification: the umbrella term for removing identifying information
• Pseudonymization: identifiers replaced, but reversible with a separately held key; still personal data under GDPR
• Anonymization: no reasonably likely means to identify anyone; outside GDPR under Recital 26
• HIPAA de-identification: meets Safe Harbor or Expert Determination; no longer PHI

A worked example

Take a support ticket in which a customer named Anjali writes from her work email about a failed payment, mentions her order number and phone number, and the agent replies by name. Here is how each approach would treat it.

A light de-identification pass might delete the names and leave everything else. The order number and phone number would still point to Anjali, so the result is not anonymous. Pseudonymization would replace Anjali with a code such as CUST-0419 and keep a table linking that code to her real record; the ticket is still readable and linkable, but whoever holds the table can reverse it. Anonymization would replace or remove the name, email, phone and order number, generalise the date if needed, check the free text for other clues such as her employer or city, and destroy or never create a linking table.

Only the last approach aims to take the record outside data protection law, and even then the result depends on the surrounding context. For training purposes, the useful part, which is how a failed payment was diagnosed and resolved, survives all three.

What this means when sharing data for AI

For a company sharing data with an AI partner, a few practical points follow. First, the process of anonymizing personal data is itself processing, so you need a lawful basis or permission to carry it out. Second, if a reversible key exists, keep it inside your organisation and never send it with the data. Third, write the expected standard into the agreement, including a prohibition on attempts to re-identify individuals.

Momentra's process supports this. Scope, permitted use, transfer and processing are governed by the signed agreement, and professional anonymization uses purpose-built tools to detect and remove or replace sensitive information before further use. You decide what is in scope, which means highly personal data can simply be excluded.

This is general information, not legal advice. The definitions and tests differ between jurisdictions, including India's Digital Personal Data Protection Act 2023, and depend on your circumstances, so consult a qualified lawyer about the standard that applies to your data.