What is the legal difference between the two?
The difference is binary: pseudonymized data stays inside GDPR, anonymous data leaves it. Recital 26 says so on both ends — pseudonymized data that can be attributed to a person by using additional information is personal data, while data-protection principles do not apply to information rendered anonymous.
Pseudonymization is an excellent security measure — GDPR names it approvingly in its security and data-protection-by-design provisions — but it is not an exemption. Legal basis, security duties, data-subject rights: everything still applies to pseudonymized data.
| Pseudonymization | Anonymization | |
|---|---|---|
| Restoration key | Exists, kept separately | None / available to no one |
| Legal status | Still personal data | Outside GDPR (Recital 26) |
| Holder's obligations | All GDPR duties remain | No data-protection duties |
| Reversibility | Reversible — by design | Not reasonably reversible |
The deciding question: who holds the key?
Data's status is assessed from the standpoint of whoever holds it, using the means reasonably likely to be used for identification. If the replacement happened on your side and the key stays only with you, a recipient of the document — an AI engine included — receives data that is anonymous for them: no reasonable way back to the identities.
Two rules therefore decide everything: the key never travels with the document, and the replacement itself must happen somewhere under your control — not on a third-party server that sees the original.
Why are consistent tokens the practical answer?
Blanket deletion of names makes a document worthless — you can't follow who signed, who committed, who received. Consistent replacement solves that: every occurrence of the same person gets the same token, so the document stays readable and analyzable.
- Consistency — "John Miller" becomes PERSON_001 in all 30 occurrences; the chain of events survives.
- AI usability — a model analyzing the document reaches correct conclusions, because the relationships between the parties are preserved.
- Control over legal status — no key kept: anonymization. A key kept only by you: pseudonymized on your side, anonymous for every recipient of the document.
- Mapping back — when needed, results can be mapped onto the original — on your machine only.
How does this work in practice with AI tools?
The full workflow — scanning, human review, consistent replacement and Metadata cleaning — is laid out in our document anonymization guide. The result: what reaches the AI tool contains no personal data at all, and the replacement map never leaves your organization.