Is anonymised data personal data?

Not if it is truly anonymous. The ICO says anonymous information does not relate to an identified or identifiable person, and data protection law does not apply to it. Anything that does not meet that threshold must be treated as personal data.

Is pseudonymised data anonymous?

No. The ICO says pseudonymous information is still personal data and the law applies to it, because people can be identified from additional information held separately. It describes anonymisation as a way of reducing the personal data you hold and pseudonymisation as a way of reducing the risks of holding it.

Does anonymising data need a lawful basis or a DPIA?

It needs a lawful basis. The ICO says applying anonymisation techniques to personal data counts as processing, so you need a lawful basis, a clearly defined purpose and a way to provide people with information about it. It also says to use a data protection impact assessment to structure and document your decisions. The anonymous result is outside data protection law, but the process is not.

Is removing names enough to anonymise records?

No. The ICO says simply removing direct identifiers from a dataset is insufficient to ensure effective anonymisation. People can be identified through indirect identifiers, by singling out and by linking records, so test the result with the motivated intruder test.

Does de-identified mean the same as anonymised?

No. The ICO does not encourage the term as a synonym for anonymous information or pseudonymous data, because its meaning varies and it can lead to confusion. Section 171 of the Data Protection Act 2018 uses it for one offence, and there it covers personal data.

ICO anonymisation guidance, explained for company records

Updated 4 November 2026 Sources UK company guides · How we make money

The ICO treats information as anonymous only when nobody is reasonably likely to identify the people it relates to. UK GDPR does not apply to anonymous information, but it does apply to the work of anonymising. Removing names is not enough, and pseudonymised data is still personal data. Test the result and take advice before you share anything.

What the ICO means by anonymous

The ICO says anonymous information is data that does not relate to an identified or identifiable person. It is not personal data, and data protection law does not apply to it. Data counts as effectively anonymised when people are not, or are no longer, identifiable. Anything that does not meet that threshold must be treated as personal data.

The UK spelling is anonymised. US sources write anonymized. The meaning is the same.

Term	What the ICO says	Does UK GDPR apply?
Personal data	Information relating to an identified or identifiable person	Yes
Pseudonymised data	Personal data in which direct identifiers are replaced or separated, so people can still be identified using additional information held separately	Yes
Anonymous information	Information that does not relate to an identifiable person, or personal data made anonymous so the person is no longer identifiable	No
“De-identified” data	A label the ICO does not encourage as a synonym for the other terms, used in section 171 of the Data Protection Act 2018	Section 171 calls it de-identified personal data

The ICO says people often call a dataset anonymised when it still holds personal data in pseudonymised form, and that this risks a mistaken belief that the law does not apply. If you can still identify people using additional information you hold separately, the data is pseudonymised. Some sources write pseudo-anonymised. The term in UK GDPR is pseudonymisation, which Article 4(5) defines.

Section 171 makes it an offence to re-identify de-identified personal data knowingly or recklessly without the controller’s consent. There the Act means personal data that can no longer be attributed, without more, to a specific person. It labels one offence. It does not describe a state of data outside UK GDPR.

Check the records before they are destroyed

Check eligibility

Anonymising is itself processing

The ICO says applying anonymisation techniques to personal data counts as processing. The result is outside data protection law, but the procedure is not. You need a lawful basis for it, a clearly defined purpose and a way to give people information about it. The ICO says applying these techniques to data you hold will in general be fair and lawful.

The ICO also says anonymisation is not always necessary or possible. The nature of the data, your purposes or the context can rule it out. For large datasets with a wide range of personal data, it says you may need specialist expertise beyond its guidance.

Removing names is not enough

The ICO says a person can be identifiable even if you do not know their name, and that you should not focus only on removing obvious identifiers. It names two indicators. Singling out means isolating the records that relate to one person. Linkability means combining records about the same person, which the ICO also calls the mosaic or jigsaw effect. It says simply removing direct identifiers from a dataset is insufficient to ensure effective anonymisation.

In our reading, this matters for the records companies usually hold. Support tickets, emails, chat logs and CRM notes carry names in free text. They also carry job titles, locations, account numbers, dates and project names that can point to one person. The ICO gives a workplace example: an employee may work out that an absence statistic relates to a colleague they know is on long-term sick leave.

Identifiability sits on a spectrum. The test is the means reasonably likely to be used to identify someone, taking account of cost, time and technology. The ICO says the risk cannot always be reduced to zero, but the more feasible and cost-effective a method becomes, the more likely you should treat it as used.

The motivated intruder test

The ICO says you must use the motivated intruder test to assess the risk. Assume someone who is reasonably competent, has access to resources such as the internet, libraries and public documents, and uses investigative techniques, such as asking people who may know more. The test asks whether that person would succeed.

The ICO says to review your assessment regularly, and to re-assess before you give access to new recipients and when the purpose of the anonymised data changes.

Who holds the data matters

The ICO calls the status of data in each party’s hands the “whose hands” question. The same information can be personal data in your hands and anonymous in the hands of a recipient who has no additional information and no means reasonably likely to obtain it. You must be able to show that sharing apparently anonymous information will not lead to an inappropriate disclosure of personal data.

The approach has limits. If the recipient is a joint controller or your processor, the status of the data in your hands is what matters. For anonymisation inside your own organisation, the ICO says that if you keep information that would allow identification, you are still holding personal data. Whether a buyer would act for you or on its own account is a question for a solicitor, and we do not answer it here.

Governance and records of decisions

The ICO says to use a data protection impact assessment (DPIA) to structure and document your anonymisation decisions, and that you must document your key decisions and the reasons for them. The ICO also says it is less likely to take enforcement action if you can show a serious effort to comply and a genuine reason to believe the information was not personal data.

The ICO separates open release, where anyone can use the data, from limited access, where only a restricted group can. In our reading, licensing records to one buyer looks more like limited access. For limited access it lists safeguards that include purpose limitation, restricting disclosure outside the environment, prohibiting re-identification, limiting copies, and destroying or returning the data once the project is complete.

Staff records

The ICO’s employment guidance covers sharing workers’ information in an acquisition, merger, reorganisation or insolvency. It says to consider due diligence, establish a lawful basis for sharing, tell workers, document decisions and, wherever possible, anonymise the information before sharing it with another organisation in connection with a prospective acquisition, merger or reorganisation. Treat staff records as the highest-risk part of your inventory.

Closing companies and liquidators

The ICO’s due diligence guidance says that on an insolvency, data might be sold as an asset to a different legal personality, and that an insolvency practitioner may take the role of controller for the time being. Its advice for small organisations says a closing business remains the controller of the personal data it holds, and that a liquidator or administrator takes over the key decisions. That page carries an under-review banner.

Our guides to members’ voluntary liquidation and creditors’ voluntary liquidation explain who takes control of the records, and how long to keep business records covers what you must keep before anything is deleted.

Client data, NDAs and processors

A processor may only process personal data on the controller’s documented instructions, under a contract (Article 28(3) of UK GDPR). The ICO says that if a processor acts outside its instructions or processes for its own purposes, it steps outside its role and becomes a controller for that processing. Article 28(10) says the same where a processor infringes the Regulation by determining the purposes and means of processing.

A company that holds personal data for clients as their processor therefore has no obvious basis to license it for its own purposes. The ICO does not say that in terms, and the last step is our reading. We found no official source on how NDAs and client contracts limit licensing, so read each contract and ask a solicitor. Our guide to company records and data licensing explains the ownership test.

Sending data abroad

The ICO says every restricted transfer must be covered by UK adequacy regulations, appropriate safeguards or an exception. If UK GDPR does not apply to the information, it is not a restricted transfer, so properly anonymised data raises no transfer question under that rule. Records that still hold personal data do, so ask a solicitor about the transfer before anything leaves.

A short checklist

These steps are our own summary of the ICO’s process: assess whether the data includes personal data, establish whether you can anonymise it, test the result, adjust and document the decision.

Inventory. List the systems and files you would license and who owns each. Set aside client data and anything under an NDA until you have read the contract.
Classify. Mark where personal data sits, including free-text fields, attachments and staff records.
Remove. Remove or anonymise personal data. Start with direct identifiers, then look at indirect identifiers and combinations.
Test. Apply the motivated intruder test, and check what else a recipient could combine the records with.
Document. Record the purpose, the lawful basis, the DPIA, the test and your decision. Keep the originals secure.
Take advice. Ask a solicitor before records that still hold personal data go to anyone else, and before you rely on a buyer’s process in place of your own.

If the guidance changes

The ICO pages we read carry banners saying the guidance is under review after the Data (Use and Access) Act 2025. gov.uk says most of the Act’s data protection and privacy provisions in Part 5 came into force on 5 February 2026. From 30 September 2026 the functions of the Information Commissioner passed to the Information Commission, but we say ICO because that is the name on the pages we read. The pages cited here are dated copies, so check the live versions.

Check the records before they are destroyed

Some company records can be licensed for AI training. Answer four questions to see whether yours might qualify, without sharing any files.

Check eligibility

Next steps

Start with the inventory, mark where personal data sits, and ask a solicitor to review your plan before any record leaves the company.

Frequently asked questions

Is anonymised data personal data?: Not if it is truly anonymous. The ICO says anonymous information does not relate to an identified or identifiable person, and data protection law does not apply to it. Anything that does not meet that threshold must be treated as personal data.
Is pseudonymised data anonymous?: No. The ICO says pseudonymous information is still personal data and the law applies to it, because people can be identified from additional information held separately. It describes anonymisation as a way of reducing the personal data you hold and pseudonymisation as a way of reducing the risks of holding it.
Does anonymising data need a lawful basis or a DPIA?: It needs a lawful basis. The ICO says applying anonymisation techniques to personal data counts as processing, so you need a lawful basis, a clearly defined purpose and a way to provide people with information about it. It also says to use a data protection impact assessment to structure and document your decisions. The anonymous result is outside data protection law, but the process is not.
Is removing names enough to anonymise records?: No. The ICO says simply removing direct identifiers from a dataset is insufficient to ensure effective anonymisation. People can be identified through indirect identifiers, by singling out and by linking records, so test the result with the motivated intruder test.
Does de-identified mean the same as anonymised?: No. The ICO does not encourage the term as a synonym for anonymous information or pseudonymous data, because its meaning varies and it can lead to confusion. Section 171 of the Data Protection Act 2018 uses it for one offence, and there it covers personal data.