Anonymized Data

What is anonymized data?

Anonymized data is data changed so that no one can identify the person it was about, now or later. Under the EU's GDPR, truly anonymous data is not personal data, so the law stops applying to it.

Recital 26 sets the bar. The principles "should therefore not apply to anonymous information." But to decide whether data is anonymous, you must consider "all the means reasonably likely to be used" to identify someone, including cost, time and available technology.

Anonymized vs pseudonymized

Pseudonymized data looks similar but is treated very differently. It has names or IDs swapped for codes, while someone still holds the key to link them back. Article 4(5) defines pseudonymisation as processing so the data can no longer be tied to a person without extra information kept separately.

Recital 26 is clear that pseudonymized data that could be linked back to a person "should be considered to be information on an identifiable natural person." In plain terms, it is still personal data and the GDPR still applies.

• Anonymized: no reasonable way back to the person. Outside the GDPR.
• Pseudonymized: a way back exists, even if it is locked away. Still inside the GDPR.

Why it matters to you

Vendor terms can use "anonymized" as a gate. A clause may let the vendor use anonymized data for any purpose, forever. If what the vendor calls anonymized is really pseudonymized, it is still personal data, and the promises in your DPA should still apply to it.

Zoom's terms of service show the pattern. They let Zoom aggregate data "on a de-identified or anonymized basis" and use it to develop its services and create benchmarks.

The word is easy to write and hard to achieve. Data such as usage logs or call transcripts can contain enough detail to point back to a person or a company.

What to check

• How the vendor defines anonymized data, and whether it means truly anonymous or only pseudonymized.
• Whether the clause names a method or standard for anonymization.
• Whether the vendor promises not to re-identify the data.
• What the vendor may do with it, including AI training and sharing with others. See also aggregated data.

How Venpo helps

Venpo monitors your vendors' terms, privacy policies and DPAs and emails you when an anonymized data clause is added or widened. The Fine Print Scan also shows whether each vendor trains AI on your data.