Anonymization
Anonymization is processing data such that the individual it once related to can no longer be identified by any means reasonably likely to be used — done correctly, the result falls entirely outside GDPR’s scope, unlike pseudonymized data.
Privacy law
The GDPR standard, drawn from Recital 26, is demanding: data counts as anonymous only if re-identification is not "reasonably likely" using any means available to the controller or a third party, accounting for cost, time, available technology, and technological development. This is a higher bar than simply removing names — direct identifiers can be stripped while enough quasi-identifiers (age, postcode, employer, rare combinations of attributes) remain to re-identify a person through cross-referencing with other datasets, a repeatedly demonstrated failure mode in supposedly anonymized releases.
Genuine anonymization techniques include aggregation (reporting statistics over groups rather than individual records), generalization (broadening precise values like exact age into ranges), k-anonymity and differential-privacy approaches (mathematically bounding how much any single record influences an output), and irreversible deletion of the linking data needed to re-identify pseudonymized records. The test is outcome-based, not method-based: a technique claimed as "anonymization" that still permits realistic re-identification is legally pseudonymization at best.
Because true anonymization is hard to achieve and verify, organizations often rely on pseudonymization plus access controls and legal safeguards instead — and stay within GDPR’s scope as a result, rather than claiming an anonymization exemption they can’t defend.