Pseudonymisation is not anonymisation: a note for people building health apps in the EU

I review data flows for health projects quite often, and one sentence appears in almost every design document: "the data are anonymised". Then I look closer and the data are pseudonymised. The difference is not academic. Under the GDPR it decides whether the law applies at all.

The two words

Pseudonymised data are personal data where the direct identifiers (name, insurance number) were replaced with something else, a random ID or a hash, but where someone could still link it back with additional information that is kept separately. The GDPR defines this in Article 4(5) and is very clear that pseudonymised data are still personal data. All the obligations apply.

Anonymised data can no longer be linked to a person by any means reasonably likely to be used, by you or by anyone else. Truly anonymous data fall outside the GDPR. That is why everybody wants to write "anonymised", and why it is so often wrong.

Why hashing the name is not enough

• A plain hash of a name or an insurance number is reversible in practice. The input space is small, so you simply hash all candidates and compare. If you need stable pseudonyms, use a keyed function (an HMAC with a secret stored somewhere else) or a random mapping table, and protect that key like the data itself.
• The remaining fields identify people. Date of birth, postcode and sex together are unique for a large part of the population. Add an admission date and a rare diagnosis and very often you have exactly one person.
• Free text is the worst. Clinical notes contain names of relatives, places, professions. Automatic de-identification of free text helps, but it is never complete.

What to do instead

1. Write "pseudonymised" in your documents when it is pseudonymised. Your lawyers and your users deserve the correct word.
2. Minimise. If the analysis needs age groups, export age groups, not birth dates. If it needs the month, do not export the day.
3. Health data are a special category under Article 9. You need a valid basis to process them in the first place, and consent is only one option, not always the right one.
4. If you really need anonymous data, involve someone who does this professionally and test the re-identification risk. Techniques like k-anonymity or added noise have limits, especially with small populations and rare conditions.

This is not legal advice, and every country adds its own health data rules on top. But if your design says "anonymised" and the next column is the date of birth, please read this twice.