EDPB 2025: Pseudonymization Guidelines Explained
Updated for 2026
What Changed in January 2025
The European Data Protection Board issued Guidelines 01/2025 in January 2025. The topic: pseudonymization. The main point is short. Pseudonymized files are still personal files. They stay inside the scope of the law. Many teams had assumed they were outside it. The new guidelines say no.
If your org holds the key to undo the process, the rules still apply to you.
The Pseudonymization Domain
The guidelines add one new idea: the pseudonymization domain. This is the group of parties who can link a pseudonymized item back to a real person.
Any party in that group is covered by the law. If you hold the key — or can work it out — you are in that group. All rules apply.
Two Terms. One Gap.
These two terms are not the same.
True anonymization cannot be undone. No party can reverse it — now or later. Truly anonymized files fall outside the scope of the law.
Pseudonymization can be undone. A key, a lookup table, or a side file can bring back the original values. Those items stay inside the law for any party that holds the key.
Three tool types that produce pseudonymized — not anonymized — output:
- Token systems: swap PII for fixed tokens and keep a lookup table
- Encrypt tools: lock PII values and keep the unlock key
- Format-preserving encryption tools
Hashing is closer to true anonymization — but only when inputs are hard to guess. For short names or common ID codes, lookup attacks can undo the hash. The EDPB flags this risk. Hashing easy-to-guess values may not count as true anonymization.
Steps for DPOs
Review each file set labeled "anonymized." Ask: can any party undo this? If yes, it is pseudonymized. The law still applies.
Files that must stay outside the law's scope — analytics, archives, research totals — need steps that cannot be undone. Options: permanent redaction, masking with no-recovery values, or hashing of hard-to-guess inputs. Log the method and your reason for it.
Files where the process must be undoable — research re-contact, audit trails, legal hold — must be labeled as pseudonymized personal files. Keep all legal duties. Log key custody using the EDPB key rules.
The five-method framework maps onto this split. Replace, Mask, and Encrypt produce pseudonymized output. Redact and Hash (hard-to-guess inputs only) can reach true anonymization — subject to completeness review.
Check what your tools actually produce. A product sold as an "anonymization" tool may put out pseudonymized items if it keeps any lookup or key. Our GDPR compliance guide covers all classification rules. Our security compliance overview explains the technical controls DPOs must log. For tool guidance, see our anonymization presets and audit guide.
When This Approach Has Limits
Classifying output by whether any party can reverse it — the pseudonymization domain — is the right way to apply Guidelines 01/2025, and the Replace/Mask/Encrypt versus Redact/Hash split is sound. But three limits apply.
Reversibility relocates the burden; it does not lift it. Choosing Encrypt or a token map for files that must stay undoable is legitimate, but the result stays personal data and the duty shifts to key custody. Whoever holds the key, or can derive it, sits inside the domain with full obligations. Key separation under EDPB 05/2022, access logging, and destruction schedules then become the live controls. Treating reversible output as a finished step understates the ongoing custody work it creates.
Redact and Hash reach anonymization only if detection is complete. A one-way method outside scope still depends on the tool having found every identifier first, and detection carries a residual false-negative rate. A missed free-text mention or an unhandled quasi-identifier keeps a record linkable even after redaction, so the output is pseudonymized in effect despite the method chosen. Hashing only helps for high-entropy inputs; for short names or common codes, lookup attacks reverse it. Run a completeness review against real files before claiming any output is out of scope.
The classification is a judgment a regulator tests. The guidelines describe a standard; deciding whether a specific dataset is truly anonymized is an expert determination a DPA can revisit, weighing means reasonably likely to be used by any party. A tool can produce the output and the log, but it cannot certify its own status. Keep a DPO reasoning through and documenting each classification, because the label that survives an audit is the one a human can defend, not the one the product asserts.