# What is pseudonymised data, and is it still personal data?

The answer decides whether UK data protection law applies to a dataset, and for whom.

The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026.

**The short answer.** Yes. Under UK data protection law, pseudonymised data is still personal data for anyone who holds the additional information that links it back to people. Shared without that information, it may be anonymous information in the other organisation's hands ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) and [ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

## What is pseudonymisation?

Pseudonymisation replaces the details that identify a person and keeps them separately. The ICO gives the example of replacing names or other identifiers with a reference number ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 22 October 2026).

The ICO describes one input and two outputs. The original personal data goes in. A pseudonymised dataset and the additional information come out ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

In this guide we call that additional information the key. It is the information that allows people to be identified again ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) and [ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

Avoid the word de-identified as a stand-in. The ICO does not encourage it as another word for anonymous or pseudonymous data ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

## Pseudonymised data: the definition in UK GDPR

UK GDPR Article 4(5) defines pseudonymisation as “the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information”. That additional information must be “kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person” ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 22 October 2026).

Both parts matter. The data cannot be tied to a person on its own. And the key is kept apart and protected ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 22 October 2026).

A weak job does not count. The ICO says an inadequate level of pseudonymisation does not meet the legal definition. That holds even if the technique fits a technical meaning of the word ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

## Is pseudonymised data still personal data?

Pseudonymised data is still personal data for anyone who holds the key. The ICO says it is personal data in the hands of someone who holds the additional information. The law applies to it ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) and [ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

The reason is the meaning of personal data. UK GDPR Article 4(1) covers information about a person who can be identified, directly or indirectly ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 22 October 2026).

Pseudonymisation weakens the link between people and their data. It does not remove the link ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

The answer can change when the data moves. If you share pseudonymised data with another organisation, but not the key, it may be anonymous information in their hands. You should consider whether it is reasonably likely that someone else, including the organisation you share with, can identify people ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) and [ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

The ICO calls this the whose hands question. It only applies when the other organisation is not your processor or a joint controller. A processor works on your behalf, so the status of the data in your hands is what matters ([ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

The ICO says its guidance on pseudonymisation is under review because of changes made by the UK's Data (Use and Access) Act, and may change ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

**Is the pseudonymised data personal data in your hands?**

Does any of these apply to you?

- You hold the additional information: for example, The table that links reference numbers to names

OR

- You are a processor or joint controller for an organisation that holds it: for example, The status in that organisation's hands is what matters

OR

- Someone could reasonably identify people from the data by other means: for example, Including the organisation you share it with

Treat it as personal data.
It may be anonymous information in your hands.

Any one of these answers yes makes it personal data for you. The ICO guidance is under review, so check the current version.

Source: ICO, Pseudonymisation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/ (checked 22 October 2026); ICO, How do we ensure anonymisation is effective?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/ (checked 22 October 2026)

## Pseudonymised or anonymous: what is the difference?

Anonymous information does not relate to an identified or identifiable person, so it is not personal data. Data protection law does not apply to it ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

The test is practical. Information is anonymised if no means are reasonably likely to be used, by you or anyone else, to identify someone. Recital 26 of the UK GDPR points to objective factors such as the cost, the time and the technology available ([ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

Keep the key, and you still hold personal data. The ICO says the dataset is then pseudonymised, rather than anonymised ([ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

The labels often slip. The ICO notes it is common to call datasets anonymised when they still hold personal data in pseudonymised form ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

**Personal, pseudonymised and anonymous data under UK law**

| Question | Personal data | Pseudonymised data | Anonymous information |
| --- | --- | --- | --- |
| What is it? | Information about a person who is identified or can be identified, directly or indirectly. | Personal data processed so it cannot be tied to a person without separate additional information. | Information that does not relate to an identified or identifiable person. |
| Does data protection law apply? | Yes. | Yes, for anyone who holds the additional information. | No. |
| Can it be linked back to people? | Yes. | Yes, with the additional information. | Not by any means reasonably likely to be used. |
| What does the step do? | This is the starting point. | Reduces the risks of the personal data you hold. | Reduces the amount of personal data you hold. |

Source: legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/4 (checked 22 October 2026); ICO, Introduction to anonymisation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/ (checked 22 October 2026); ICO, Pseudonymisation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/ (checked 22 October 2026); ICO, How do we ensure anonymisation is effective?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/ (checked 22 October 2026)

## How do firms pseudonymise data?

To pseudonymise data, the ICO names hashing, encryption and tokenisation as the most common techniques ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

For hashing, the ICO advises against algorithms that use no additional data, such as a salt, pepper or encryption key. It also advises against outdated algorithms such as MD5 and SHA-1 ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

Tokenisation replaces identifiers with randomly generated tokens. In an ICO example, a retailer gives each loyalty card customer a unique pseudonym instead of their direct identifiers ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) and [ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

Then protect the key. The ICO says to store it apart from the pseudonymised data, for example in a separate database. Access should be limited to authorised personnel ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

Decide on the technique, decide whether you or a processor does the work, and write down your decisions and risk assessments ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

Reversing it without permission can be a crime. Section 171 of the UK's Data Protection Act 2018 makes it an offence to knowingly or recklessly re-identify de-identified personal data. That applies where the controller responsible has not consented ([legislation.gov.uk, Data Protection Act 2018](https://www.legislation.gov.uk/ukpga/2018/12/section/171), checked 22 October 2026).

Under that section, personal data is de-identified if it can no longer be attributed, without more, to a specific data subject. There are defences, including where re-identification was justified as being in the public interest ([legislation.gov.uk, Data Protection Act 2018](https://www.legislation.gov.uk/ukpga/2018/12/section/171), checked 22 October 2026).

## Why pseudonymise if the law still applies?

Pseudonymisation is named in the law as a security measure. UK GDPR Article 32 asks controllers and processors for security appropriate to the risk. Its examples include, as appropriate, the pseudonymisation and encryption of personal data ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/32), checked 22 October 2026).

It can soften a breach. The ICO says pseudonymisation can reduce the risk of harm to people from personal data breaches ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

It helps when you want to use data for something new. Under UK GDPR Article 8A, you weigh several factors to decide whether a new purpose fits the original one. One factor is safeguards such as encryption or pseudonymisation ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/8A), checked 22 October 2026).

For research, archiving and statistics, UK GDPR Article 84C says the safeguards must include measures that respect data minimisation, such as pseudonymisation. The UK's Data (Use and Access) Act 2025 inserted these rules, which were fully in force from 5 February 2026 ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/84C), checked 22 October 2026).

In the ICO's words, anonymisation reduces the amount of personal data you hold. Pseudonymisation reduces the risks of the personal data you hold ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

## What to do

1. List the datasets your team calls anonymised, and check whether anyone in the organisation still holds the key ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/) and [ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).
2. Treat pseudonymised data as personal data in your records and security work ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).
3. Before you share a pseudonymised dataset, consider whether the recipient, or anyone else, could reasonably identify people from it ([ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).
4. Check that any hashing uses a salt, pepper or key, and does not rely on MD5 or SHA-1 ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).
5. Keep the key in a separate place, with access limited to authorised personnel ([ICO, Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/), checked 22 October 2026).

## Common questions

### Is pseudonymisation the same as anonymisation?

No. Pseudonymised data can be linked back to people with the additional information, so it is still personal data. Anonymous information does not relate to an identifiable person, and data protection law does not apply to it ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/), checked 22 October 2026).

### Does anonymising or pseudonymising data count as processing?

Yes. The ICO says applying anonymisation techniques to personal data counts as processing personal data. UK GDPR Article 4(5) also describes pseudonymisation as the processing of personal data ([ICO, Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 22 October 2026).

### What if we receive anonymous data and can identify people?

Then it is personal data for you. The ICO says that if you receive data described as anonymous but can re-identify people, you must treat it as personal data ([ICO, How do we ensure anonymisation is effective?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/), checked 22 October 2026).

## Where next

- [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md)
- [What are the UK GDPR principles? All seven, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md)
- [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md)
- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md)

## Sources

- ICO, Pseudonymisation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/ (checked 22 October 2026)
- ICO, Introduction to anonymisation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/ (checked 22 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/4 (checked 22 October 2026)
- ICO, How do we ensure anonymisation is effective?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/ (checked 22 October 2026)
- legislation.gov.uk, Data Protection Act 2018: https://www.legislation.gov.uk/ukpga/2018/12/section/171 (checked 22 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/32 (checked 22 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/8A (checked 22 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/84C (checked 22 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.