De-identified, anonymized, pseudonymized: what these words actually mean

A hospital tells a patient her data will be "anonymized" before it goes to researchers. A vendor's brochure promises "de-identified" datasets. A European data-sharing agreement specifies "pseudonymized" records. Three documents, three different words, and a reasonable person would assume they describe roughly the same thing: data with the names taken out.

They do not. Each word names a distinct legal status, carrying distinct obligations, in distinct jurisdictions. The looseness with which they get swapped is not a style problem. It is how data that is still legally personal ends up being treated as if it were not.

Three words, three regimes

The cleanest way to keep these straight is to remember that the words come from different rulebooks and answer different questions. De-identification is a HIPAA concept about leaving US health-privacy law. Anonymization and pseudonymization are GDPR concepts about whether European data-protection law applies at all.

Under HIPAA, "de-identified" means a covered entity has removed identifiers to one of two defined standards, after which the data is no longer protected health information and the rule no longer governs it. Under the GDPR, "anonymous" data is information that does not relate to an identifiable person — and such data sits entirely outside the regulation. "Pseudonymized" data, by contrast, is data that has been disguised but can still be re-attributed using information kept separately; it remains personal data, and GDPR continues to apply to it in full. One of these words means "outside the law." Two of them are doing very different jobs across an ocean.

What the regulations actually say

The precise wording matters here, because the protections hang on it. The GDPR is unusually clear, and worth quoting directly rather than paraphrasing.

On anonymous data, Recital 26 draws the line:

The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.

The same recital adds the crucial test for whether someone is "identifiable": account must be taken of "all the means reasonably likely to be used" to identify them. Anonymization is therefore not a checklist — it is an outcome measured against a realistic attacker.

Pseudonymization gets its own definition in Article 4(5):

'pseudonymisation' means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Read those two together and the architecture is obvious: anonymization aims to make re-identification impossible by any reasonable means, so the law steps back; pseudonymization keeps re-identification possible by design, so the law stays. HIPAA's version of "stepping back" is its own de-identification guidance, which defines two routes — Safe Harbor and Expert Determination — that we compare in HIPAA Safe Harbor vs. Expert Determination.

Reversibility is the whole game

The single property that separates these terms is reversibility — whether the data can be turned back into something that points at a named person. This is where the words most often get misused, usually in the direction that under-protects.

Pseudonymization is reversible on purpose. You replace identifiers with a token and keep a key elsewhere; with the key, you can re-link. That is a feature — it lets a hospital re-contact a patient about a critical finding — but it is also why the data is still personal. Anonymization is meant to be irreversible: the key is destroyed, the granularity is coarsened, and re-identification is pushed below the threshold of "reasonably likely." HIPAA de-identification sits somewhere pragmatic in between — it reduces re-identification risk to a low level under defined methods, but, as the re-identification literature shows, "low" is not "zero," especially as outside datasets accumulate.

That gap matters because the famous privacy failures are almost all stories of supposedly de-identified data being re-linked using auxiliary information. We catalogue them in re-identification attacks, and the mechanism that bounds the risk — making each person hide in a crowd — is the subject of k-anonymity, explained with a hospital waiting room.

The map, on one page

Held side by side, the three terms sort cleanly across the dimensions that actually determine your obligations.

The table also exposes a trap for anyone working across borders: HIPAA de-identified is not automatically GDPR anonymous. The European test is stricter and outcome-based, so a dataset lawfully de-identified in the US can still be personal data in Europe — a mismatch that surfaces constantly in international research and feeds the GDPR health-research rules.

Why the vocabulary is a control, not a footnote

Because each label switches a different set of legal protections on or off, the words function as controls. Calling pseudonymized data "anonymized" is not imprecision; it is a claim that GDPR no longer applies, and if that claim is wrong, the protections that should have followed the data simply do not. The cheapest privacy breach in the world is a mislabel on a spreadsheet.

Mithras Health resolves the ambiguity by refusing to lean on the weakest interpretation. Patient records remain identifiable and within the patient's own control — pseudonymized at most, never quietly relabeled as anonymous — while anything that leaves for research is an aggregate, produced under a hard k-anonymity floor of k ≥ 5 and returned by federated queries that run in-region so raw records do not cross borders to be re-identified elsewhere. The point is to build to the strictest applicable standard rather than the most convenient word.

That is the practical takeaway behind all three definitions. The terms are not interchangeable, the protections ride on which one is true, and the only safe habit is to use the word that matches the strongest law in play. When in doubt, assume the data still points at a person — because, more often than the brochures admit, it does.