Anonymization and pseudonymization are two distinct techniques for disguising the identity behind personal data, even though the two are often treated as interchangeable. The distinction actually determines whether a given dataset still falls under data protection law at all.
A classic study by Harvard researcher Latanya Sweeney found that 87 percent of the United States population can be identified from nothing more than ZIP code, birth date, and gender. The finding shows that simply removing a name from a dataset does not necessarily make it truly anonymous.
Misunderstanding the difference between anonymization and pseudonymization can lead a company to misjudge its own compliance position. This article covers how the two differ, their legal basis, and how to choose the right technique for your business.
What Are Anonymization and Pseudonymization in Personal Data?
Anonymization is the process of altering personal data so that it can no longer be linked back to a specific individual, even by the party that performed the alteration. Once this process succeeds, the resulting data is no longer considered personal data, since its identifying trail has been permanently removed.
Pseudonymization is the process of replacing an individual’s real identity in a dataset with an artificial code or token, while the original identity can still be restored using additional information kept separately. Because that link back to the individual can still be restored, pseudonymized data remains classified as personal data under the law.
The Difference Between Anonymization and Pseudonymization
The most fundamental difference between the two comes down to whether the data can still be traced back to its original identity. The table below summarizes the key differences based on the Guidelines on Pseudonymisation from the European Data Protection Board.
| Aspect | Anonymization | Pseudonymization |
|---|---|---|
| Reversibility | Cannot be restored to the original identity | Can be restored using additional information kept separately |
| Status as personal data | No longer classified as personal data | Still classified as personal data |
| Scope under data protection law | No longer subject to data protection law | Still subject to the full set of data protection obligations |
| Common techniques | Generalization, aggregation, permanent deletion | Tokenization, encryption with a separately held key |
Legal Basis for Anonymization and Pseudonymization Under Indonesia’s PDP Law
Indonesia’s PDP Law does not explicitly use the terms anonymization or pseudonymization, but the obligation to apply proportionate technical measures still binds every data controller. Here is the relevant legal basis for both techniques.
Article 35 of Indonesia’s PDP Law requires data controllers to establish and apply technical operational measures to protect personal data, with a security level matched to the nature and risk of the data being processed. This provision is written broadly, leaving companies free to choose the concrete technique that fits, including anonymization or pseudonymization.
By comparison, Article 32(1)(a) of the GDPR explicitly names pseudonymization and encryption as examples of appropriate security measures. This more explicit approach can serve as a practical benchmark for Indonesian companies looking to confirm that their own technical measures are genuinely adequate.
As with the PDP Law’s other obligations, this requirement applies extraterritorially, meaning a foreign company processing the personal data of people in Indonesia is bound by it even without a local entity. That makes the distinction between anonymization and pseudonymization directly relevant to any company handling Indonesian customer data from abroad.
When Should You Use Anonymization, and When Pseudonymization?
The choice between anonymization and pseudonymization depends on whether the company will still need access to the original identity later on. Here is a practical guide for determining which technique fits the need at hand.
Anonymization for Data That No Longer Needs to Be Traced
Anonymization works well when data no longer needs any link to an individual’s identity, such as for statistical reporting or aggregate research. A good example is annual sales data broken down by region, where there is no need to know which specific customers made which purchases.
Because the change is permanent, anonymization also suits situations where a company wants to share data with a third party without taking on an ongoing set of PDP Law obligations. Data that has been genuinely anonymized can be handled more freely, since it falls outside the legal definition of personal data altogether.
Pseudonymization for Data That Still Needs to Be Recognized
Pseudonymization fits better when a company still needs to recognize the individual behind the data for operational purposes, such as linking a transaction history to the same customer without exposing their name to every staff member. This technique keeps data analysis running without exposing the original identity to parties who do not need it.
Pseudonymization is also relevant for system testing or application development that requires realistic data without the risk of leaking a real customer’s identity. Because its legal status remains personal data, a company must still apply the full set of PDP Law obligations to any data it has pseudonymized.
Common Anonymization and Pseudonymization Techniques
Each anonymization and pseudonymization technique works differently, depending on the type of data and the business need behind it. The two groups of techniques below are the ones most commonly found in practice.
Common anonymization techniques include generalization, which blurs data details such as replacing an exact age with an age range, and aggregation, which combines individual data points into group figures so no single personal data point remains visible. Another technique is statistical noise addition, which injects small random variation into numerical data so individual patterns become difficult to trace back.
Common pseudonymization techniques include tokenization, which replaces real data with a random token that can only be mapped back through a separate system, and encryption using a key stored apart from the data itself. Data masking also counts as one widely used pseudonymization technique, particularly for disguising data in testing or development environments.
The Risk of Getting Anonymization or Pseudonymization Wrong
Applying anonymization or pseudonymization incorrectly can leave a company still bound by PDP Law obligations without realizing it, and that can lead to sanctions. The case below shows how this kind of mistake plays out in practice.
Denmark’s data protection authority, Datatilsynet, fined ride-hailing company Taxa 4×35 roughly 1.2 million Danish kroner, about 160,000 euros, in 2018. The company believed its data had been anonymized after deleting customer names, but the phone numbers it kept on file for five years could still identify specific individuals.
In Indonesia, a similar mistake risks an administrative sanction under Article 57 of the PDP Law, which can reach 2% of a company’s annual revenue. That sanction applies because data a company assumes is safe can still be classified as personal data subject to the full weight of PDP Law obligations.
Conclusion
Anonymization and pseudonymization both aim to protect the identity behind personal data, but their legal consequences are very different. Choosing the wrong technique can leave a company believing it is compliant when PDP Law obligations are, in fact, still fully in force.
The decision to use anonymization or pseudonymization should rest on a clear business need, not on the assumption that removing a name is enough on its own. Regularly reassessing the technique in use also matters, since re-identification risk can shift over time.
FAQ
No. Anonymization is permanent and cannot be reversed to the original identity, while pseudonymization can still be reversed using additional information kept separately.
Yes. Pseudonymized data remains classified as personal data and stays subject to the full scope of the PDP Law, since the original identity can still be restored.
No, as long as the anonymization process genuinely prevents the data from being traced back to anyone’s identity. Once a dataset fails that test, as in the Taxa 4×35 case, it is still treated as personal data.
Both are equally safe when applied to the right situation, since safety here depends on matching the technique to the intended use of the data. Anonymization is stricter for data that will be shared widely, while pseudonymization suits data still used internally.
No. The PDP Law only requires technical measures proportionate to risk under Article 35, without naming any specific technique.
Not necessarily. Data masking only counts as anonymization if the result genuinely cannot be traced back to the original identity, while masking that still keeps a mapping to the original data counts as pseudonymization.
