Anonymisation and GDPR: A Practical Guide

Harper James is a UK full-service commercial law firm advising businesses on data protection and other areas of the laws of England and Wales. Anonymisation is the process of altering information so that an individual is no longer identifiable, directly or indirectly. Under the UK GDPR, genuinely anonymous information falls outside the definition of personal data.

Anonymisation and pseudonymisation

Anonymisation is different from pseudonymisation. Pseudonymisation replaces identifying details, such as names, with codes or tokens. If the organisation can identify a person by using additional information, the data remains personal data and the UK GDPR continues to apply.

Anonymisation is assessed in context. Organisations should consider the means reasonably likely to be used to identify someone, including the cost, time, available technology and information held by other parties. Removing names alone is rarely sufficient. Dates of birth, postcodes, rare conditions, employment details or combinations of seemingly harmless fields can still identify an individual.

A practical process

A business can approach anonymisation in the following sequence:

  1. Define the purpose. Establish why the data is needed and whether identifiable information is necessary.
  2. Map the data. Record the direct identifiers, indirect identifiers, linked datasets, access rights and retention periods.
  3. Select suitable techniques. These can include aggregation, suppression, generalisation, randomisation and removal of identifying fields. The appropriate combination depends on the dataset and its intended use.
  4. Test re-identification risk. Assess whether a person could be identified using the dataset alone or by combining it with information reasonably available to the organisation or others.
  5. Document the assessment. Record the method, assumptions, testing, residual risks and approval decisions. A data protection impact assessment is appropriate where the processing is likely to create a high risk to individuals.
  6. Review the result. Reassess the dataset when its purpose, recipients, technology, surrounding information or public availability changes.

Governance and common errors

Until the organisation has established that data is truly anonymous, it should treat the information as personal data. That means applying an appropriate lawful basis, maintaining security controls, limiting access, observing retention rules and responding to data subject rights where applicable. It should also check contractual, confidentiality and sector-specific obligations, which can continue to matter even where the UK GDPR no longer applies.

Common errors include retaining a re-identification key, publishing small groups that expose unusual individuals, releasing precise location or event dates, and assuming that a third party cannot combine the dataset with other information. Anonymisation is therefore not a one-off deletion exercise. It is a documented risk assessment supported by technical controls, governance and periodic review.