Data counts as anonymised only when nobody can re-identify the people in it, by any means reasonably likely to be used. If you keep a key or a mapping anywhere, the data is pseudonymised. It is still personal data, and every duty still applies.
The test you can apply
People assume the threshold is "impossible". The law asks whether re-identification is realistic, by any means reasonably likely to be used, given cost, time and technology. The test comes from the Article 29 Working Party's opinion on anonymisation.
The rule is in Recital 26 of the GDPR, and the UK GDPR carries the same one. It applies when the people in your documents are in Europe or the UK.
- It is not about you alone. Anyone could try, including a recipient with data you have never seen. A document with no names but an office address, a date and a job title can often be traced.
- It changes over time. What was unlikely five years ago may be routine now, so date your assessment.
- It is a judgement that no tool can make for you. The tool does not know what else the recipient holds.
Anonymised or pseudonymised
- Anonymised: the link to the person is gone for good, for you and for anyone else. The GDPR no longer applies, so you need no lawful basis, no processing agreement and no handling of data-subject rights.
- Pseudonymised: identifiers become codes, and a mapping held separately can link the codes back to the person. It is a recognised security measure, and the data remains personal data. The EDPB's 2025 guidelines say so most clearly, and the UK regulator's guidance agrees.
In practice, the question is whether anyone could realistically identify the person again. If a key exists somewhere, the answer is yes.
Why it trips people up
A tool that swaps each name for [P0ABCD] produces something that looks anonymised. The names are gone and nothing on screen shows a link. But if anyone keeps the mapping, the data is pseudonymised. Keeping the mapping is what makes reversible redaction useful.
The mistake isn't using a reversible method; it's believing the GDPR no longer applies when it still does.
This applies to us too. Our reversible codes are pseudonymisation: each value becomes a code, and the map lives in a local file. Within one folder, a value keeps its code. Only permanent removal can reach anonymisation, and only if no export of the map exists.
A quick decision guide
| What you did | Status | Consequence |
|---|---|---|
| Removed every identifier, kept no key, no route back | Anonymised | Outside the GDPR |
| Replaced identifiers with codes and kept the mapping | Pseudonymised | Still personal data, every duty intact |
| Drew black boxes but left the text extractable | Neither | Full exposure, and a false sense of safety |
If you are not sure which row describes your case, treat it as the row with more duties.
Why your own device matters
There are two benefits. First, making people harder to identify lowers what you expose, whether you reach anonymisation or stop at pseudonymisation.
Second, working locally means no outside service receives the original document. Uploading a file to have it anonymised is itself a disclosure, which needs its own lawful basis and agreement.
Frequently asked questions
Does anonymising the data remove my obligations?
Only if it is true anonymisation, with no realistic route back for anyone. If you hold a mapping, it is pseudonymisation and your obligations stay. Write down why you concluded re-identification was not reasonably possible.
Can pseudonymised data be shared freely?
No, it is still personal data. A transfer needs a lawful basis and, if the recipient processes it for you, an agreement. Pseudonymisation reduces risk, but it is no exemption.
Which should I use, anonymisation or pseudonymisation?
It depends on whether you need the values back. Use permanent removal when you never will, and reversible codes when you must match or restore names later. The second is pseudonymisation, so plan for the GDPR duties.
Is encrypting the mapping enough to call it anonymised?
No, because you still hold the means to reverse it, so the data stays personal data for you. Our own registry is a local file, deliberately not encrypted, since the unredacted original sits on the same disk. What matters more is that the map never travels with the file.
In short
Before you call data anonymised, ask whether anyone could realistically re-identify the person, and write down why not. If a key exists, treat the data as covered by the GDPR.
promptShield works on PDFs and Office documents on your own device. It offers permanent removal and reversible codes, so you can choose the status you need. Try it on your own document.