The Information Commissioner’s Office (ICO) in the United Kingdom published draft guidance on anonymisation and pseudonymisation for research, archiving and statistical (RAS) purposes in August of this year. The guidance itself focuses on RAS purposes, but it is also helpful for understanding the ICO’s position on anonymisation and pseudonymisation more generally.

Anonymisation and Anonymous Information

Firstly, I want to introduce the definitions of anonymisation and anonymous information that are provided in this guidance. I then want to explore the implied relationship between anonymisation and anonymous information and the concepts that underpin this relationship.

I start with the definition of anonymous information:

The implication of this definition is that anonymous information is not personal data as the UK GDPR only applies to personal data. The guidance later confirms this interpretation:

Next, I move on to the definition of anonymisation:

One might assume from this definition that anonymisation is a process whose output is anonymous information. That is, input to the anonymisation process is personal data and output from the anonymisation process is anonymous information.

However, many different techniques and approaches can applied to a given set of personal data to generate the output of the anonymisation process. Output from the anonymisation process may therefore take many forms. Some of these forms may not fulfil the definition of anonymous information presented above. So, simply applying some techniques and approaches within what is considered to be an anonymisation process does not lead to the output of anonymous information.

Effective Anonymisation

The key concept in the guidance that determines whether an anonymisation process outputs anonymous information (and therefore whether it can be considered an anonymisation process at all by the definition above) is whether that anonymisation process is effective.

An effective anonymisation process results in anonymous information, whereas an anonymisation process that is not effective results in an output that is not anonymous information - which can be reasonably considered to be personal data by the definition of anonymous information above.

For organisations that are stakeholders in an anonymisation process, the key question is whether a given anonymisation process can be reasonably considered to be effective. If so, the organisation can have a degree of confidence that the output is anonymous information. Required safeguards for downstream processing can then be determined on the basis that the data is not personal data and therefore not subject to the UK GDPR.

How then do organisations determine whether a proposed anonymisation process is effective? Based on the guidance:

An effective anonymisation process would appear to be determined on the basis of an identifiability risk assessment. Implied is that when the identifiability risk assessment finds the identifiability risk to be sufficiently low, the anonymisation process can be considered effective and the output can be considered anonymous information. Otherwise, the anonymisation process cannot be considered to be effective and the output cannot be considered to be anonymous information.

Guidance helpfully provides some factors to consider in an assessment of identifiability risk, including:

It perhaps helpful at this point to clarify what is meant by a release model in the factors stated above:

To undertake an identifiability risk assessment, an organisation must be able to robustly distil down appropriate representations of these (and potentially other) factors - which we could refer to as the context - into an identifiability risk measure. When the value of this measure fulfils a specified threshold - that is, the identifiability risk is sufficiently low - the organisation can have that degree of confidence that the anonymisation process is effective and the output is anonymous information.

Whose Hands Assessment

Guidance states the use of a whose hands assessment (or test) to help in determining identifiability risk; defining this assessment as:

It would appear that identifiability risk is dependent on the party, or parties, to which the data is to be released. This seems sensible as different parties will have different willingnesses and abilities to reidentify individuals from the data. For example, a public release model is likely to carry higher risk than a limited access release model, ceterus paribus.

Based on the definition of the whose hands assessment above, it would appear that information can be personal data to one party and anonymous information to another party. So, identifiability risk and whether data is considered anonymous information appears to be determined on a whose hands basis.

This position also appears to be taken by the European Data Protection Board (EDPB) in their Guidelines 02/2026 on Anonymisation, in which they state:

Whilst there is far more to explore in relation to identifiability risk and whose hands assessments and their roles in effective anonymisation, I want to close this particular article by highlighting an area that I believe would benefit from further clarification.

If the ‘status of information’ - whether or not it is anonymous information - is contingent on whose hands, then one party can receive data that is anonymous information to them, and to which the UK GDPR does not apply (see definition of anonymous information). How then would this data be protected from onward transfer to, and downstream processing by another party, for whom the data may not be anonymous information? It seems that safeguards would still be required as the status of anonymous information is dependent on context that may not hold for this downstream processor.

Summary

Organisations must navigate significant complexities and potential ambiguities when designing, implementing and evaluating anonymisation processes. By exploring the relationship between anonymisation and anonymous information, I hope this article will support greater understanding of these concepts within organisations and highlight some areas of complexity and potential ambiguity that would benefit from further thought.