What is pseudonymised data, and is it still personal data?

What is pseudonymisation?

Pseudonymisation replaces the details that identify a person and keeps them separately. The ICO gives the example of replacing names or other identifiers with a reference number.

The ICO describes one input and two outputs. The original personal data goes in. A pseudonymised dataset and the additional information come out.

In this guide we call that additional information the key. It is the information that allows people to be identified again.

Avoid the word de-identified as a stand-in. The ICO does not encourage it as another word for anonymous or pseudonymous data.

Pseudonymised data: the definition in UK GDPR

UK GDPR Article 4(5) defines pseudonymisation as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information”. That additional information must be “kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person”.

Both parts matter. The data cannot be tied to a person on its own. And the key is kept apart and protected.

A weak job does not count. The ICO says an inadequate level of pseudonymisation does not meet the legal definition. That holds even if the technique fits a technical meaning of the word.

Is pseudonymised data still personal data?

Pseudonymised data is still personal data for anyone who holds the key. The ICO says it is personal data in the hands of someone who holds the additional information. The law applies to it.

The reason is the meaning of personal data. UK GDPR Article 4(1) covers information about a person who can be identified, directly or indirectly.

Pseudonymisation weakens the link between people and their data. It does not remove the link.

The answer can change when the data moves. If you share pseudonymised data with another organisation, but not the key, it may be anonymous information in their hands. You should consider whether it is reasonably likely that someone else, including the organisation you share with, can identify people.

The ICO calls this the whose hands question. It only applies when the other organisation is not your processor or a joint controller. A processor works on your behalf, so the status of the data in your hands is what matters.

The ICO says its guidance on pseudonymisation is under review because of changes made by the UK's Data (Use and Access) Act, and may change.

Pseudonymised or anonymous: what is the difference?

Anonymous information does not relate to an identified or identifiable person, so it is not personal data. Data protection law does not apply to it.

The test is practical. Information is anonymised if no means are reasonably likely to be used, by you or anyone else, to identify someone. Recital 26 of the UK GDPR points to objective factors such as the cost, the time and the technology available.

Keep the key, and you still hold personal data. The ICO says the dataset is then pseudonymised, rather than anonymised.

The labels often slip. The ICO notes it is common to call datasets anonymised when they still hold personal data in pseudonymised form.

How do firms pseudonymise data?

To pseudonymise data, the ICO names hashing, encryption and tokenisation as the most common techniques.

For hashing, the ICO advises against algorithms that use no additional data, such as a salt, pepper or encryption key. It also advises against outdated algorithms such as MD5 and SHA-1.

Tokenisation replaces identifiers with randomly generated tokens. In an ICO example, a retailer gives each loyalty card customer a unique pseudonym instead of their direct identifiers.

Then protect the key. The ICO says to store it apart from the pseudonymised data, for example in a separate database. Access should be limited to authorised personnel.

Decide on the technique, decide whether you or a processor does the work, and write down your decisions and risk assessments.

Reversing it without permission can be a crime. Section 171 of the UK's Data Protection Act 2018 makes it an offence to knowingly or recklessly re-identify de-identified personal data. That applies where the controller responsible has not consented.

Under that section, personal data is de-identified if it can no longer be attributed, without more, to a specific data subject. There are defences, including where re-identification was justified as being in the public interest.

Why pseudonymise if the law still applies?

Pseudonymisation is named in the law as a security measure. UK GDPR Article 32 asks controllers and processors for security appropriate to the risk. Its examples include, as appropriate, the pseudonymisation and encryption of personal data.

It can soften a breach. The ICO says pseudonymisation can reduce the risk of harm to people from personal data breaches.

It helps when you want to use data for something new. Under UK GDPR Article 8A, you weigh several factors to decide whether a new purpose fits the original one. One factor is safeguards such as encryption or pseudonymisation.

For research, archiving and statistics, UK GDPR Article 84C says the safeguards must include measures that respect data minimisation, such as pseudonymisation. The UK's Data (Use and Access) Act 2025 inserted these rules, which were fully in force from 5 February 2026.

In the ICO's words, anonymisation reduces the amount of personal data you hold. Pseudonymisation reduces the risks of the personal data you hold.

What to do

1. List the datasets your team calls anonymised, and check whether anyone in the organisation still holds the key.
2. Treat pseudonymised data as personal data in your records and security work.
3. Before you share a pseudonymised dataset, consider whether the recipient, or anyone else, could reasonably identify people from it.
4. Check that any hashing uses a salt, pepper or key, and does not rely on MD5 or SHA-1.
5. Keep the key in a separate place, with access limited to authorised personnel.

Common questions

Is pseudonymisation the same as anonymisation?

No. Pseudonymised data can be linked back to people with the additional information, so it is still personal data. Anonymous information does not relate to an identifiable person, and data protection law does not apply to it.

Does anonymising or pseudonymising data count as processing?

Yes. The ICO says applying anonymisation techniques to personal data counts as processing personal data. UK GDPR Article 4(5) also describes pseudonymisation as the processing of personal data.

What if we receive anonymous data and can identify people?

Then it is personal data for you. The ICO says that if you receive data described as anonymous but can re-identify people, you must treat it as personal data.

Where next

• Keeping personal data secure: what Article 32 requires
• What are the UK GDPR principles? All seven, in plain English
• Is UK GDPR changing in 2026?
• Who is a data controller, and who is a processor?
• When must you report a personal data breach?

This is an independent editorial guide, not legal advice.