What is the difference between anonymization and pseudonymization?

Anonymization and pseudonymization are two techniques for reducing the privacy risk in records that contain personal information. They are often confused, but they differ in one decisive way: whether the connection back to a specific person can ever be restored.

Anonymization

Anonymization transforms data so that an individual can no longer be identified, directly or indirectly, by anyone. Done properly, it is irreversible — there is no key, lookup table, or additional dataset that can re-link the data to a person. Common approaches include aggregating values, generalizing details (for example, replacing an exact birth date with a birth year), and suppressing or removing identifiers.

Because truly anonymized data no longer relates to an identifiable individual, it generally falls outside the scope of many privacy and data-protection obligations. The challenge is that genuine anonymization is hard. Combining “anonymized” data with other available information can sometimes re-identify people, so organizations must assess re-identification risk rather than assume a few removed fields are enough.

Pseudonymization

Pseudonymization replaces identifying fields with artificial identifiers, or pseudonyms — such as a code or token — while keeping a separate “key” that can reverse the process. The data is no longer directly attributable to a person without that additional information, which is stored and protected separately.

Crucially, pseudonymized data is still considered personal information, because it can be re-linked. It reduces risk and supports data minimization, but it does not remove the underlying record from privacy and recordkeeping obligations.

Why the difference matters for records professionals

• Reversibility: anonymization is one-way; pseudonymization is reversible by design.
• Legal status: anonymized data is typically out of scope for privacy rules; pseudonymized data remains personal data.
• Use case: pseudonymization suits situations where you may need to re-identify later (research follow-up, audit, fraud investigation); anonymization suits open publication and long-term retention with minimal risk.
• Governance: with pseudonymization, the separate key becomes a sensitive record requiring its own access controls and retention.

Treat both as risk-reduction tools, not guarantees. Frameworks such as the NIST Privacy Framework can help you document and manage these decisions. For more guidance, see the privacy and PII topic hub.