Masking, pseudonymizing, anonymizing and encrypting: what each one means and what it cannot do
Five words are often used as if they meant the same thing. This guide explains how masking, hashing, pseudonymization, anonymization and encryption differ, which can be reversed, and what the law says about each.
Tools, vendors, and policies use "masked," "pseudonymized," "anonymized," "hashed," and "encrypted" as if they were interchangeable. They are not. Each changes data in a different way, each can or cannot be undone, and the law treats them differently. Choosing the wrong one leaves personal data in a file you thought was clean, or destroys detail you needed.
Key terms
- Personal data
- any information about an identified or identifiable person. In the EU's General Data Protection Regulation (GDPR) a person is identifiable if they can be identified directly or indirectly, for example by a name, an identification number, or a combination of facts.
- Pseudonym
- a replacement for a real value that does not itself reveal the person. The same real value can always receive the same pseudonym, which keeps records linkable.
- Additional information
- whatever is needed to link a pseudonym back to the real value, such as a lookup table or a secret key.
- Hash
- a fixed-length code calculated from a value. The same value always gives the same code, and the calculation cannot be run backwards.
- Key
- a secret value used to encrypt or to calculate a keyed hash. Whoever holds the key can do what the key allows.
What is the short answer?
| Method | What it does to a value | Can the original be recovered? | Is the result still personal data? |
|---|---|---|---|
| Masking or redaction | Hides part of the value or replaces all of it with fixed text: +44 ** **** **23, [ADDRESS] |
Not from the output | Often yes, if what remains can still identify the person |
| Hashing | Replaces a value with a code calculated from it | Not by reversing it, but common values can be guessed (see below) | Often yes |
| Pseudonymization | Replaces a value with a stand-in, keeping the link elsewhere | Yes, by whoever holds the additional information | Yes, in EU law |
| Encryption | Scrambles a value so that only the key holder can read it | Yes, with the key | Yes, for the key holder and for anyone who might obtain the key |
| Anonymization | Changes the data until the people in it can no longer be identified | No | No, if it really works. That is a high bar |
What is masking?
Masking hides part of a value and keeps the rest. A phone number becomes +44 ** **** **23; a card number keeps its last four digits. Redaction goes further and replaces the whole value with a fixed text such as [ADDRESS].
Masking is simple and its result cannot be reversed from the output. Its weakness is what remains. The last four digits plus a date and an amount may still point to one transaction. A masked name next to an unmasked job title in a small team may still be obvious.
What is hashing, and why is it not a lock?
A hash turns a value into a code, and the calculation cannot be run backwards. People therefore assume a hashed name is private. It often is not.
Why a plain hash of a name can be guessed
Suppose you replace each customer's email address with its SHA-256 hash. Anyone who has a list of candidate email addresses can hash each one and see which hash matches. This is a dictionary attack. It works because names, emails, phone numbers, and postal codes come from small, guessable sets, and because the calculation is the same for everybody: the same input always gives the same code.
A keyed hash adds a secret key to the calculation, so an outsider without the key cannot repeat it. Equal values still get equal codes, which keeps joins and counts working, and the original still cannot be recovered. The protection holds only as long as the key stays secret. If the key and the file travel together, the benefit is gone.
What is pseudonymization?
Pseudonymization replaces real values with stand-ins and keeps the link to the real values somewhere else. The GDPR defines it in Article 4(5) as processing personal data so that it can no longer be attributed to a specific person without additional information, provided that this information is kept separately and protected by technical and organizational measures.
Two consequences follow.
- It keeps your analysis working. If
PERSON_017always stands for the same customer, you can still count orders per customer, follow one account through the year, and join two files. - It does not make the data non-personal. The European Data Protection Board published guidelines on pseudonymization in January 2025 (for public consultation at the time) that say pseudonymized data remains personal data when the additional information exists and could be used. The UK Information Commissioner's Office says the same in its anonymization guidance, published in March 2025.
What is encryption?
Encryption scrambles a value so that only someone with the key can read it. It is the strongest way to protect a value you must be able to get back, and it is reversible by design.
The trade-off for analysis is that ordinary encryption destroys the form of the data. An encrypted date is not a date and an encrypted amount cannot be added up. Format-preserving encryption is a family of methods that produce a result of the same shape, such as a ten-digit number from a ten-digit number.
Format-preserving encryption in one paragraph
The US National Institute of Standards and Technology (NIST) describes format-preserving methods in its publication SP 800-38G. Its second public draft revision, published in February 2025, specifies a method called FF1 and no longer specifies FF3, because a weakness was found in FF3 and its successor. If you meet a product that uses format-preserving encryption, ask which method, which key handling, and which version of the standard it follows. A shape-preserving result is convenient for a database column, but it is still encrypted data that someone with the key can read.
What is anonymization, and why is it hard?
Anonymization means the people in the data can no longer be identified by anyone, using any means reasonably likely to be used. Recital 26 of the GDPR says the rules on personal data do not apply to anonymous information. That is why the word is attractive, and why it is claimed too often.
The difficulty is the phrase "reasonably likely." The ICO describes a practical test: could a reasonably competent person who is determined to identify someone, and who can use the internet and public records, identify individuals in the data? Whether the answer is yes depends on what other data exists. Research has repeatedly shown that removing names is not enough, because a few ordinary facts together can single out a person (see how to remove personal details from a spreadsheet).
Which one should you use?
Start from what you need to do afterwards.
| If you need to… | Consider | Keep in mind |
|---|---|---|
| Show a recipient the shape of the data but none of the values | Redaction or masking | Check what remains in combination |
| Analyze behavior per person without naming anyone | Pseudonymization with a consistent stand-in | The data is still personal data; protect the link |
| Count or join across files without being able to go back | Keyed hash | Keep the key away from the file |
| Hold values you must get back and nobody else should read | Encryption | Protect the key; a lost key means lost values |
| Share a table that no longer describes individuals | Aggregation, grouping, rounding, then test | This is the hardest to achieve; test it, and seek expert advice |
| Keep amounts and trends but hide exact figures | Rounding, banding, adding a fixed factor | Ratios and rankings may still show |
How does DataAttendant describe its own results?
DataAttendant offers these treatments, applied to the columns you choose: remove, redact, partial mask, stable pseudonym, synthetic replacement, keyed hash, reversible encryption, round, bucket, scale, date shift, pattern replace, and block. It shows a preview and lists what remains in the protected copy, and it says for each treatment whether the original can be restored. It does not claim that a protected copy is anonymous, compliant, or free of risk. That judgment is yours, and it depends on who receives the file and what else they hold.
Sources
- Regulation (EU) 2016/679 (GDPR): Article 4(1) (personal data), Article 4(5) (pseudonymisation), Recital 26 (identifiability and anonymous information).
- European Data Protection Board, Guidelines 01/2025 on Pseudonymisation, adopted 16 January 2025 for public consultation. The EDPB website showed this consultation version on 28 October 2026, and no final version was found.
- UK Information Commissioner's Office, anonymisation and pseudonymisation guidance, published 28 March 2025 and marked by the ICO as under review because of the Data (Use and Access) Act (identifiability, the motivated intruder test, pseudonymized data remains personal data). Read on the ICO website on 28 October 2026.
- NIST SP 800-38G Revision 1, second public draft, 3 February 2025: FF1 specified; FF3 no longer specified. Read at csrc.nist.gov on 28 October 2026.