What is the difference between de-identification/pseudonymization (CCPA) and anonymization (GDPR)?

When data is anonymized, ideally the reference to a person is completely removed. The process is also not reversible. Examples of anonymized data are statistics on population figures, an average income of a specific group of people, or survey results for clinical studies.

With pseudonymization/de-identification, on the other hand, the reference to a person is retained. Information such as name, age, telephone number is not deleted, but merely replaced by a pseudonym. Here, storing a username in the database as person 184875 would be an example.

Reviewed August 2026. This article was written in March 2023 and has not been individually updated since. Privacy law has moved considerably in that time. For the current position across all major jurisdictions, see our maintained overview of data privacy laws worldwide.