Anonymized vs de-identified vs pseudonymized data – when is company data clean enough?

"All personal data is removed before delivery." Almost every company data deal includes some version of that sentence. Whether it is true depends on what "removed" means, which law applies and what kind of data it is. Structured data such as CRM exports can often be cleaned reliably. Free text such as email, Slack and support tickets is much harder. This guide explains the terms, what US and EU law generally require, and what a process that holds up looks like.

This guide describes how things generally work today. It is not legal advice. Every dataset and every deal is different – what applies is assessed case by case. You don't have to sort it out alone – we walk you through each step, bring in specialists where needed and propose deals that work for you.

Why the question matters now

In 2026, de-identification became the center of the debate about selling workplace data. When Spirit Airlines' email and Teams archive was sold in bankruptcy, the buyer said the data would be scrubbed by a third party. More than 120 members of Congress replied in a letter that removing names and email addresses does not necessarily make a dataset anonymous. MIT Technology Review quoted an attorney calling such archives "legally radioactive", pointing to private details like medical appointments in emails and calendars.

For a seller, that means two things: buyers will ask how the data was cleaned, and the answer has to hold up.

Three terms, three meanings

• Anonymized data – no person can be identified by any means reasonably likely to be used, by anyone. Truly anonymous data generally falls outside privacy law, but the bar is high.
• De-identified data – a defined legal term in US law. Under the CCPA it is information that cannot reasonably be linked to a particular consumer, and the business must meet specific conditions (see below).
• Pseudonymized data – names and identifiers are replaced with codes or placeholders. Someone holding the key, or enough context, can restore the link. It reduces risk but is not anonymization.

In practice, much of what is marketed as "anonymized" is really pseudonymized: names are swapped for placeholders, but the rest of the text is untouched.

What US law requires

The CCPA definition of de-identified

Under the CCPA (Cal. Civ. Code §1798.140(m)), information only counts as de-identified if it cannot reasonably be linked to a consumer and the business holding it:

1. takes reasonable measures to ensure the information cannot be associated with a consumer or household,
2. publicly commits to maintain and use it in de-identified form and not to attempt to re-identify it, and
3. contractually obligates any recipients to comply with the same requirements.

That is why a data license typically includes a ban on re-identification. Since 2023 the CCPA also covers employee data, so it can apply to workplace archives too.

The FTC on hashing

The FTC has stated plainly that "hashing still doesn't make your data anonymous" (July 2024). A hashed email address can still be used to identify or track a person. Describing hashed data as anonymous can be treated as a deceptive claim.

What EU law says

If the data includes EU or UK residents – customers, contacts or staff – GDPR generally applies. Anonymous data is outside GDPR. Pseudonymized data has traditionally been treated as personal data.

In September 2025, the EU Court of Justice nuanced that view in EDPS v SRB (C-413/23 P). The court held that pseudonymized data is not automatically personal data for every recipient. For a recipient with no realistic means of re-identifying anyone, it may fall outside GDPR – but it remains personal data for the party that holds the key. For sellers, the practical point is largely unchanged: before and during de-identification, the data is generally still personal data in their hands.

Why email and chat are hard to clean

In a spreadsheet, personal data sits in known columns. In free text it can appear anywhere:

• Indirect identifiers. "The new CFO in our Denver office" identifies one person without a name.
• Context across messages. A single message may be harmless, but a thread over two years reveals who someone is.
• Signatures, quotes and forwards. Earlier emails in a thread repeat names, numbers and addresses.
• Sensitive details in passing. "Out Thursday for my chemo appointment" is health information in an ordinary scheduling message.
• Attachments. CVs, contracts and invoices inside an archive are full of personal data.

That is why selection matters more than any single redaction tool.

What a defensible process looks like

1. Select first. Exclude DMs, HR, legal, personal mailboxes and anything with health or financial details. Less data in means less risk out.
2. Redact direct identifiers. Names, email addresses, phone numbers, addresses, account numbers and IDs are replaced with consistent placeholders.
3. Handle indirect identifiers. Job titles, locations, rare events and customer names are generalized where they could single someone out.
4. Spot-check by hand. Automated redaction misses things. A sample is reviewed manually, and the process is adjusted.
5. Bind the buyer. The license typically bans re-identification, onward transfer and resale.
6. Document everything. What was excluded, which methods were used and what the spot checks found. The documentation also helps buyers meet training-data transparency rules such as California's AB 2013 and, for buyers serving the EU, the EU AI Act.

Summary

"Anonymized", "de-identified" and "pseudonymized" are not interchangeable. The CCPA's de-identification standard requires safeguards, a public commitment and contractual bans on re-identification. The FTC has said hashing is not anonymization. In the EU, pseudonymized data generally remains personal data for whoever holds the key. And for email and chat, removing names is only the start. Select carefully, redact in layers, check by hand and put the limits in the contract. More on the legal side in our overview of data privacy and AI training.