Pseudonymised isn't anonymised: where the ICO draws the line
Replace every name in a file with a code and it feels anonymous, but under UK GDPR that's still personal data if anyone can link it back.
The ICO's view
The ICO's anonymisation guidance, published in 2025, treats identifiability as a spectrum, not a switch. Pseudonymised data, where a key can restore identities, remains personal data.
The identifiability spectrumBased on ICO anonymisation and pseudonymisation guidance (2025)
What that means in practice
Keep or destroy the key, but never send it to a buyer.
Test the output: could a motivated intruder re-identify people?
Reassess when new data becomes available that could enable linking.
Key takeaways
Codes alone don't anonymise.
Anonymisation is judged in context and can change over time.
