Glossary
Anonymisation
Irreversibly transforming data so no person is identifiable by any means reasonably likely to be used, taking it outside GDPR scope (Recital 26).
The GDPR does not define anonymisation in its articles. Recital 26 explains that the principles of data protection do not apply to anonymous information, meaning information that does not relate to an identified or identifiable natural person, or personal data rendered anonymous in such a manner that the data subject is no longer identifiable. The test is whether identification is possible using all the means reasonably likely to be used, by the controller or by another person.
The Article 29 Working Party's Opinion 05/2014 on anonymisation techniques sets out three risks any technique must address: singling out (isolating one individual's records), linkability (linking records about the same person across datasets) and inference (deducing information about a person). If any of these remains realistic, the data is at best pseudonymised and still personal data.
For security and IT teams the distinction has real consequences. Data labelled "anonymised" in analytics, test environments or threat-intelligence sharing is often only pseudonymised, which means GDPR obligations such as security, retention limits and breach notification still apply. Removing names while keeping IP addresses, timestamps or rare attribute combinations rarely achieves anonymisation. See our guide to pseudonymisation vs encryption for how the concepts compare.