Anonymous or pseudonymised data? The difference the GDPR cares about

“The names are replaced with codes, so it's not personal data anymore.” It's a sentence you hear often once an organisation starts running AI tools on its own documents, and it's almost always wrong. The GDPR distinguishes two very different operations, and the difference decides whether a rule applies at all.

Two words that are not synonyms

Pseudonymisation (GDPR, Art. 4(5)): data is replaced with placeholders — [NAME_1], [TAX_ID_1] — but a mapping exists somewhere that can restore the original value. Even if that mapping sits on an encrypted disk, far from the pseudonymised text, the data stays personal: the regulation says so explicitly, because the possibility of re-identification still exists, somewhere.

Anonymisation: the mapping is destroyed, not just hidden. At that point nobody — not even whoever performed the operation — can trace it back to a person. Only here does GDPR recital 26 truly apply: anonymous data is no longer personal data, and the regulation stops covering it.

Why context alone can give someone away

There's a third, less intuitive problem: even well pseudonymised text can stay identifiable from context. A case file saying “the majority shareholder of the electrical contractor in [CITY], founded in [YEAR]” can identify a specific person to anyone who knows that area, even without their name. That's why an AI provider — which only ever receives text with placeholders, never the mapping — could still, in theory, trace it back to someone from context: the text remains personal data, and the GDPR still governs the processing.

What this means in practice for using AI at work

• Connecting your own API key to an AI provider and sending pseudonymised text is still processing of personal data, and should be treated as such: legal basis, notice, any data processing agreement with the provider.
• The fact that the provider never receives the mapping table lowers the risk, it does not remove it.
• Promising “anonymous” when you mean “pseudonymised” exposes an organisation to a claim that won't hold up under scrutiny.

obscurIA keeps the two operations distinct by name, rather than blurring them: it pseudonymises when the real values need to come back in the reply, and anonymises when text must leave for good. obscurIA's built-in AI chat only ever works on text that is already protected, using the customer's own API key — never ours — so the relationship with the provider stays the one the customer chose.