Back to BlogGDPR & Compliance

EDPB 2025: Pseudonymization Guidelines

EDPB Guidelines 01/2025 clarified that pseudonymized data remains personal data under GDPR — only true anonymization falls outside GDPR scope.

May 7, 20269 minute read
EDPB 2025 pseudonymizationanonymization vs pseudonymization GDPRGDPR scope personal dataDPO compliance gappseudonymization domain

EDPB 2025: Pseudonymization Guidelines Explained

Updated for 2026

What Changed in January 2025

The European Data Protection Board issued Guidelines 01/2025 in January 2025. The topic: pseudonymization. The main point is short. Pseudonymized files are still personal files. They stay inside the scope of the law. Many teams had assumed they were outside it. The new guidelines say no.

If your org holds the key to undo the process, the rules still apply to you.

The Pseudonymization Domain

The guidelines add one new idea: the pseudonymization domain. This is the group of parties who can link a pseudonymized item back to a real person.

Any party in that group is covered by the law. If you hold the key — or can work it out — you are in that group. All rules apply.

Two Terms. One Gap.

These two terms are not the same.

True anonymization cannot be undone. No party can reverse it — now or later. Truly anonymized files fall outside the scope of the law.

Pseudonymization can be undone. A key, a lookup table, or a side file can bring back the original values. Those items stay inside the law for any party that holds the key.

Three tool types that produce pseudonymized — not anonymized — output:

  • Token systems: swap PII for fixed tokens and keep a lookup table
  • Encrypt tools: lock PII values and keep the unlock key
  • Format-preserving encryption tools

Hashing is closer to true anonymization — but only when inputs are hard to guess. For short names or common ID codes, lookup attacks can undo the hash. The EDPB flags this risk. Hashing easy-to-guess values may not count as true anonymization.

Steps for DPOs

Review each file set labeled "anonymized." Ask: can any party undo this? If yes, it is pseudonymized. The law still applies.

Files that must stay outside the law's scope — analytics, archives, research totals — need steps that cannot be undone. Options: permanent redaction, masking with no-recovery values, or hashing of hard-to-guess inputs. Log the method and your reason for it.

Files where the process must be undoable — research re-contact, audit trails, legal hold — must be labeled as pseudonymized personal files. Keep all legal duties. Log key custody using the EDPB key rules.

The five-method framework maps onto this split. Replace, Mask, and Encrypt produce pseudonymized output. Redact and Hash (hard-to-guess inputs only) can reach true anonymization — subject to completeness review.

Check what your tools actually produce. A product sold as an "anonymization" tool may put out pseudonymized items if it keeps any lookup or key. Our GDPR compliance guide covers all classification rules. Our security compliance overview explains the technical controls DPOs must log. For tool guidance, see our anonymization presets and audit guide.

When This Approach Has Limits

Classifying output by whether any party can reverse it — the pseudonymization domain — is the right way to apply Guidelines 01/2025, and the Replace/Mask/Encrypt versus Redact/Hash split is sound. But three limits apply.

Reversibility relocates the burden; it does not lift it. Choosing Encrypt or a token map for files that must stay undoable is legitimate, but the result stays personal data and the duty shifts to key custody. Whoever holds the key, or can derive it, sits inside the domain with full obligations. Key separation under EDPB 05/2022, access logging, and destruction schedules then become the live controls. Treating reversible output as a finished step understates the ongoing custody work it creates.

Redact and Hash reach anonymization only if detection is complete. A one-way method outside scope still depends on the tool having found every identifier first, and detection carries a residual false-negative rate. A missed free-text mention or an unhandled quasi-identifier keeps a record linkable even after redaction, so the output is pseudonymized in effect despite the method chosen. Hashing only helps for high-entropy inputs; for short names or common codes, lookup attacks reverse it. Run a completeness review against real files before claiming any output is out of scope.

The classification is a judgment a regulator tests. The guidelines describe a standard; deciding whether a specific dataset is truly anonymized is an expert determination a DPA can revisit, weighing means reasonably likely to be used by any party. A tool can produce the output and the log, but it cannot certify its own status. Keep a DPO reasoning through and documenting each classification, because the label that survives an audit is the one a human can defend, not the one the product asserts.

Sources

Ready to protect your data?

Start anonymizing PII with 285+ entity types across 48 languages.

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our company HQ is in Saarbrücken, Germany. Our servers run in Hetzner's Falkenstein datacenter.

Hetzner holds ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.