Data licensing guide
Data licensing guide

Anonymised vs pseudonymised vs de-identified data

By Ade Molajo · Updated · How we check figures · Not legal advice · Not reviewed by a lawyer

Quick answer

Anonymised data can't be linked to a person by anyone, so it's outside UK GDPR. Pseudonymised data has names swapped for codes; someone with the key could re-identify people, so it's still personal data under UK GDPR. 'De-identified' is mostly a US term: under HIPAA, health data is de-identified if it meets the Safe Harbor or Expert Determination standard.

Anonymised
outside UK GDPR
Pseudonymised
still personal data
De-identified
HIPAA's term, two standards
Key
who could re-identify decides it

01Side by side

UK GDPR and HIPAA compared: under UK GDPR, anonymised data is outside the law and pseudonymised data is still personal data; under HIPAA, de-identified data meets the Safe Harbor or Expert Determination standard and is outside HIPAA.UK GDPRHIPAA (US health)Outside the lawAnonymised data: no one can beidentifiedDe-identified health informationStill coveredPseudonymised data (codes for names)Identifiable health informationHow you get thereEffective anonymisation; the ICO’sguidanceSafe Harbor or Expert DeterminationRegulatorThe ICOHHS
The headline definitions only. Take advice for your situation.

02Under UK GDPR

The ICO's anonymisation guidance is the reference. Anonymised data is no longer personal data, so UK GDPR doesn't apply to it. Pseudonymised data, where identifiers are replaced with codes but could be reversed with additional information, is still personal data.

Does UK GDPR apply to the data you license? If the records hold no personal data, or it has been properly anonymised, it does not. Pseudonymised data, with names swapped for codes, is still personal data, so UK GDPR applies.YesYesNoNoAny personal data init?Properly anonymised?Outside UK GDPRUK GDPR applies(pseudonymised too)UK GDPR doesn’t apply
From the ICO’s anonymisation guidance. General information, not legal advice.

03Under HIPAA (US health data)

HIPAA treats health information as de-identified when it meets one of two standards: Safe Harbor (removing a specified list of identifiers) or Expert Determination (an expert concludes the risk of re-identification is very small). See the HHS guidance. Mercor's medical practice listing asks for exactly this.

04Why it matters when you license data

If what you hand over is only pseudonymised, UK GDPR still applies to it, and to you. Ask each programme which it does, to what standard, and when. See how de-identification works.

This is general information, not legal advice, and it hasn't been reviewed by a lawyer.

05Check whether you're likely to match

Our free fit check asks about your size, location, records and tools, then shows which programmes you're likely to match. The programme decides.

06Questions people ask

Is pseudonymised data anonymous?

No. Under UK GDPR, pseudonymised data is still personal data, because it can be re-identified with additional information.

What does de-identified mean?

In US health law (HIPAA), data that meets the Safe Harbor or Expert Determination standard. Programmes also use it loosely to mean personal details removed.

Sources

Check which programmes you’re likely to matchA few short questions, about a minute. Free, no sign-up. The programme decides who qualifies.trackimpact.io/data →