Anonymous Data

Anonymous data is information from which all personal identifiers have been removed in a way that makes re-identification irreversible, taking into account all means reasonably likely to be used. Because the data no longer identifies a natural person, it is excluded from GDPR Recital 26, the DPDP Act's scope and the CCPA's definition of 'personal information'. This is a strict legal test, not a marketing label.

In practice, the line between anonymous data and merely pseudonymised data is where many compliance programmes break. Removing names and emails is not enough: a dataset keyed on date-of-birth, postcode and gender is still re-identifiable through linkage attacks. Robust anonymisation requires techniques like k-anonymity, differential privacy, aggregation beyond small-group thresholds, and documented re-identification risk assessment. Regulators apply the test strictly — if there is any reasonable path back to the individual, the data remains personal and the full compliance regime applies.