GDPR
Pseudonymisation or anonymisation? The GDPR difference, and why it matters for AI
By Hugo Ribeiro · Updated · 5 min read
In conversations about AI and data protection, the two words are used as synonyms. They aren't, and the difference is legal, not stylistic.
The definitions
Pseudonymisation is defined in article 4(5) of the GDPR: processing personal data so it can no longer be attributed to a specific data subject without additional information, provided that information is kept separately and protected by technical and organisational measures.
Anonymisation has no article of its own. Recital 26 explains that data protection principles don't apply to anonymous information, i.e. data rendered anonymous so that the person is no longer identifiable, taking into account all means reasonably likely to be used.
An example
| Original | Pseudonymised | Anonymised |
|---|---|---|
| Maria Luísa Santos, tax ID 123 456 789 | [PESSOA_1], tax ID [NIF_1] | An individual resident in Portugal |
| 2025 income: €48,210 | 2025 income: €48,210 | Income between €40k and €50k |
| Reversible? | Yes, with the key | No |
What it means when you use AI
- Whoever holds the key holds personal data. If the key stays on your computer and never reaches the AI provider, the provider gets text it can't attribute to anyone.
- Context can identify too. "The only notary in a village of 800 people" identifies someone with no name or tax ID. A pseudonymisation tool covers identifiers; reviewing context is still on you.
- Be wary of "full anonymisation" claims. If a product gives you the real data back, it's pseudonymisation.
The European Data Protection Board published dedicated guidelines on pseudonymisation (01/2025): a valuable safeguard, as long as the additional information (the key) is kept separate and protected.
How Velado applies this
Velado does pseudonymisation, and says so. It swaps tax IDs, social security numbers, ID cards, IBANs, names, companies, addresses and contacts for consistent codes, and keeps the mapping in an AES-256 encrypted vault protected by your password. The vault and the documents never leave your computer.
For information only; not legal advice.
FAQ
Is pseudonymised data personal data?
Yes, for whoever holds or can obtain the key. GDPR recital 26 says pseudonymised data that can be attributed to a person using additional information should be considered information on an identifiable person.
So what's the point of pseudonymising?
The GDPR names it as a technical safeguard (articles 25 and 32). If a pseudonymised document is lost or read by others, without the key it identifies no one.
Is a blacked-out PDF anonymised?
It may be, if the redaction is real and nothing else identifies the person. But it's irreversible: the AI's answer comes back full of black bars and you rebuild everything by hand.
Try it with your own document
Velado runs in your browser, on your computer: nothing is sent to any server.