Data Anonymization and Pseudonymization: Techniques and Legal Limits

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

The difference between anonymizing and pseudonymizing data can determine whether a company complies with the LGPD (Brazil’s General Data Protection Law) or faces multimillion-real penalties.

What anonymization and pseudonymization mean in practice

When you look at how personal data is processed under Brazil’s General Data Protection Law (Law 13.709/2018), two concepts stand out as central tools for protecting privacy: anonymization and pseudonymization. They are often confused, but they have different legal natures and produce very different effects on the obligations of the data controller.

Anonymization means using reasonable technical means, available at the time of processing, through which a piece of data irreversibly loses the possibility of being associated, directly or indirectly, with an individual. Once data has been effectively anonymized, it is no longer considered personal data for purposes of the LGPD, as Article 12 of the law provides. This means the controller is relieved of many of the legal requirements that apply to identifiable personal data.

Pseudonymization, by contrast, is an intermediate step. With this technique, direct identifiers (such as a name, CPF (Brazil’s individual taxpayer number), or address) are replaced with codes, tokens, or cryptographic keys, while the additional information needed for reidentification is kept separately in a controlled environment. Pseudonymized data remains personal data, because anyone who holds the matching key can technically reverse the process. As a result, all of the LGPD’s obligations continue to apply.

This topic is directly related to privacy impact assessments, which we cover in a dedicated article.

This topic is directly related to the processing of sensitive data, which we cover in a dedicated article.

This distinction has major practical consequences. In data due diligence, especially in mergers and acquisitions, corporate restructurings, or compliance audits, understanding which technique was applied to each data set is essential to mapping regulatory risk and measuring the organization’s exposure to administrative penalties.

Anonymization techniques and how effective they are

On the technical side, there are several ways to anonymize personal data, each with its own advantages and limitations. When we conduct a compliance assessment, we need to examine not only which technique was used, but also whether it can withstand reasonable reidentification attempts given the current state of technology.

Generalization is one of the most commonly used techniques. It replaces specific values with broader ranges or categories. For example, instead of recording an exact age of 34, we record the range “30 to 39 years.” Instead of a full CEP (Brazilian postal code), we keep only the first three digits. This technique reduces the granularity of the data and makes identification harder, but it may not be enough when the data is combined with other publicly available information.

Suppression involves completely removing fields or records that could lead to identification. We delete entire columns from a database (such as name or ID number) or exclude records of individuals who, because of their unique characteristics, would be easy to identify even without direct identifiers. The downside is the possible loss of the data set’s analytical value.

Randomization (or perturbation) adds statistical noise to the original data, altering values in a controlled way so that aggregate analyses remain valid while individual records do not match the reality of any specific person. Advanced techniques such as differential privacy make it possible to calibrate mathematically the balance between the usefulness of the data and the protection of privacy.

K-anonymity is a formal model that requires each record in a data set to be indistinguishable from at least k-1 other records with respect to certain attributes. When we apply this model with a sufficiently high k, we significantly reduce the risk of reidentification. However, research shows that k-anonymity alone can be vulnerable to homogeneity attacks and background knowledge attacks, which is why complementary models (such as l-diversity and t-closeness) were developed.

The line between anonymized data and personal data is not fixed: it shifts as reidentification technologies advance and as more data becomes available for cross-referencing.

None of these techniques offers an absolute guarantee. The effectiveness of anonymization must be assessed case by case, taking into account the specific context, the auxiliary data that may be available, and technological developments. This contextual analysis is exactly what happens during a data due diligence process.

Pseudonymization as a risk-mitigation strategy

Although pseudonymization does not take data outside the scope of the LGPD, the law expressly recognizes it as a recommended technical security measure. Article 13, paragraph 4, of the LGPD, which addresses public health studies, mentions pseudonymization as a protective mechanism. The ANPD (Brazil’s National Data Protection Authority) also recognizes the technique as good practice in its guidance documents.

In corporate practice, pseudonymization serves several important strategic purposes. When we separate direct identifiers from the bulk of operational data, we reduce the exposure surface in the event of a security incident. If a pseudonymized database is compromised, the attacker obtains records that, on their own, do not identify the data subjects, provided that the matching table (the pseudonymization key) is stored in a segregated and properly protected environment.

This separation also makes it easier to share data between internal departments or with outside partners for analytical, research, or development purposes. Teams that do not need access to identifiable data can work with pseudonymized data sets, in line with the necessity principle set out in Article 6, item III, of the LGPD.

In due diligence, when you review the data assets of a target company, the existence of robust pseudonymization policies is a positive sign of data protection maturity. On the other hand, the absence of such practices can reveal vulnerabilities that directly affect the valuation of the business and the contractual terms of the deal.

Legal limits and the risk of reidentification

Article 12 of the LGPD provides that anonymized data will not be considered personal data, unless the anonymization process can be reversed using exclusively the controller’s own means or, with reasonable effort, can be reversed. The law therefore uses a reasonableness standard to assess whether anonymization is effective, taking into account factors such as cost, time, and available technology.

This dynamic standard creates a zone of legal uncertainty that demands constant attention. Data that we consider properly anonymized today may become reidentifiable tomorrow because of new computational techniques, greater processing power, or the release of complementary databases that allow cross-referencing that was previously impossible. International studies have already shown that databases that appear to be anonymized can be reidentified at surprisingly high rates when cross-referenced with public information.

The European Union’s General Data Protection Regulation (GDPR), which directly influenced the LGPD, addresses this issue in Recital 26, which states that the assessment must consider all the means reasonably likely to be used by the controller or by third parties. The European experience offers valuable interpretive guidance, especially the opinions of the Article 29 Working Party (now the European Data Protection Board) on anonymization techniques.

For organizations that handle large volumes of data, the duty to continuously monitor the effectiveness of the anonymization techniques they use is an ongoing commitment. It is not enough to anonymize once and consider the matter closed. You need periodic reidentification risk assessments, with techniques updated whenever the technological landscape requires it.

Another important limit concerns purpose. Even anonymized data, when used for automated decisions that affect entire groups or communities, raises ethical and regulatory questions that go beyond the protection of individuals’ personal data. Using aggregated data for discriminatory purposes (such as predatory pricing based on the socioeconomic profiles of neighborhoods) may violate other legal frameworks, such as the Consumer Protection Code and anti-discrimination legislation.

Data due diligence: how to assess compliance in practice

In due diligence involving data assets, we conduct a structured analysis covering technical, legal, and organizational aspects. The goal is to map the real level of protection applied to the data, identify compliance gaps, and quantify risks that could affect the intended transaction.

On the technical side, we check which anonymization or pseudonymization techniques were actually implemented, whether the technical documentation matches actual practice, whether periodic reidentification tests exist, and whether the pseudonymization keys are stored with proper access controls. We also examine the data architecture, looking for points where personal data may be exposed without the protections stated in internal policies.

On the legal side, we analyze the legal bases used for each processing activity, the adequacy of consent forms (where applicable), the contracts with data processors and subprocessors, the records of processing operations, and the personal data protection impact assessments. We evaluate whether classifying the data as “anonymized” holds up under rigorous technical scrutiny, or whether it is an overly optimistic label that the ANPD could challenge.

On the organizational side, we look at the existence and role of the data protection officer (DPO), data protection training programs, incident response procedures, and the channels for handling data subjects’ rights requests. An organization may have excellent technical anonymization solutions yet fall short on the governance needed to ensure they are applied consistently across its operations.

The results of this analysis feed into the transaction’s risk matrix, allowing the parties to make informed decisions about pricing, indemnification clauses, post-closing obligations, and, in extreme cases, the viability of the transaction itself. Improperly handled data creates contingent liabilities that can materialize as administrative sanctions (which can reach 2% of revenue, capped at R$ 50 milhões per violation), individual or class lawsuits, and significant reputational harm.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.