Anonymisation refers to the process of modifying personal data so that the data subject can no longer be identified. According to Recital 26 GDPR, the decisive factor is whether identification is possible using means reasonably likely to be used. Effectively anonymised data no longer falls within the scope of the GDPR. Simply removing names or other direct identifiers is not sufficient to achieve anonymisation.
What is the purpose of anonymisation?
Anonymisation enables companies to analyse and reuse information without retaining the personal references contained in the original data.
In particular, it supports the principle of data minimisation under Article 5(1)(c) GDPR. This principle requires personal data to be limited to what is necessary for the purposes for which it is processed.
A typical application is the statistical analysis of customer or employee data. Where only effectively anonymised results are used, valuable insights can be gained without disclosing information about identifiable individuals.
When is personal data considered anonymised?
When assessing whether data is anonymous, Recital 26 GDPR requires all means reasonably likely to be used by the controller or another person to identify an individual to be taken into account. Relevant factors include, in particular, the time and costs required, the available technologies and the possibility of combining the data with additional information.
A merely theoretical possibility of identification does not prevent data from being considered anonymous. However, if there is a realistic possibility of identification under the specific circumstances, the data has not been effectively anonymised.
Anonymisation methods may include aggregating or generalising information or removing individual attributes. Whether these measures actually result in anonymous data depends on the residual risk of identification.
Example: A company removes all names from an employee statistics dataset. However, the statistics still contain employees' exact ages, departments and job positions. If only one person in a department matches these characteristics, that individual can still be identified. The data is therefore not anonymous in this respect.
What is the difference between anonymisation and pseudonymisation?
Anonymisation removes the personal reference to such an extent that the data subject can no longer be identified using means reasonably likely to be used.
Pseudonymisation, as defined in Article 4(5) GDPR, involves processing personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information. However, identification remains possible with the help of this additional information.
Example: A company replaces its customers' names with customer numbers and retains a separate list linking the numbers to the individuals. Since the customers can still be identified using this list, this constitutes pseudonymisation rather than anonymisation.
Pseudonymised data remains personal data and therefore continues to be subject to the requirements of the GDPR.
What are the benefits of anonymisation for companies?
Anonymisation allows information to be used for purposes such as statistical analysis, market research or internal reporting without retaining the personal reference contained in the original data.
Article 25 GDPR requires controllers to implement appropriate technical and organisational measures to implement data protection principles. Anonymisation can be one possible measure, provided it is suitable for the relevant processing purpose.
However, it should be noted that anonymising personal data itself constitutes processing within the meaning of Article 4(2) GDPR. As long as personal data is being processed, the requirements of the GDPR, including the need for a legal basis under Article 6 GDPR, must be met.
Practical example: When is customer data anonymised?
An online retailer wants to analyse its customers' purchasing behaviour. To do so, it initially stores order data containing names, customer numbers, postcodes and purchased products.
However, the company does not need information about individual customers for a general sales analysis. Instead, orders are grouped into sufficiently large product categories, and only the respective total sales figures are analysed.
If the resulting data contains no information that could be used to identify individual customers through means reasonably likely to be used, the data is considered anonymised.
legal data assessment: Before reusing anonymised data, companies should assess whether the remaining information could allow individuals to be re-identified. The risk is particularly high in small data groups or where unusual combinations of characteristics are present. Simply removing direct identifiers is not sufficient to achieve effective anonymisation.
Legal basis
Recital 26, Articles 4(2) and 4(5), Article 5(1)(c), Article 6 and Article 25 GDPR.
Frequently asked questions about anonymisation
Is removing a person's name sufficient to anonymise data?
No. Even without a name, an individual may remain identifiable if other information makes it possible to establish their identity. The decisive factor is whether the personal reference has been removed entirely.
Does the GDPR still apply to anonymised data?
Effectively anonymised data no longer falls within the scope of the GDPR, as it no longer relates to an identifiable individual. However, the data protection requirements continue to apply to the processing of the original personal data and to the anonymisation process itself.
Are companies required to anonymise personal data?
There is no general obligation for companies to anonymise all personal data. However, companies must comply with the principles of data minimisation and data protection by design. Whether anonymisation is necessary or appropriate depends on the respective processing purpose and applicable legal requirements.
Can anonymised data become personal data again?
Yes. New information or technological developments may create new possibilities for identification, meaning that the anonymity of the data must be reassessed. If individuals can be identified using means reasonably likely to be used, the data qualifies as personal data.
What is the difference between anonymised and aggregated data?
Aggregation involves combining individual data points into summary values. However, aggregated data is not automatically anonymous. If the results still allow conclusions to be drawn about individual persons, the data retains its personal reference.
Related terms.
Personal data Personal data means any information relating to an identified or identifiable natural person. Art. 4(1) GDPR Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 