Data anonymization: what it is, techniques, and the difference from pseudonymization

Data anonymization is the process of turning information that identifies a person into data that can no longer be tied to anyone, either directly or indirectly. In practice, you take a record that has a name, CPF (Brazil's individual taxpayer ID), address, and phone number and convert it into a record that is still useful for analysis but doesn't point to any real individual. When anonymization is done for real, the data stops being personal data.

This is not a legal technicality. The LGPD itself (Brazil's General Data Protection Law), Law 13.709/2018, defines anonymization as the use of reasonable technical means available at the time of processing so that the data loses the possibility of being associated with a person. And the law goes further: anonymized data, as a rule, falls outside the scope of the LGPD, because there is no longer a data subject to protect. That is the big difference from simply deleting a column or swapping a name for a nickname. Anonymizing well is what lets you use the dataset for study, testing, and model training without carrying the risk of exposing people.

The problem starts when the company thinks it anonymized and didn't. Replacing the name with a code but keeping date of birth, CEP (Brazil's postal code), and job title on the same row often still lets you trace back to the person. This happens a lot, and that is where the risk lies.

Anonymization and pseudonymization: what is the difference

These two terms are constantly treated as synonyms, and they are not. The difference is simple, and it changes everything when you have to answer for an incident.

In anonymization, the path back to the person is eliminated. Ideally it is irreversible. Done correctly, it takes the data out of the reach of the LGPD, because no one can re-identify the data subject.

In pseudonymization, the data loses its direct link to the person, but there is additional information stored separately that allows reversing it and re-identifying. The classic case is replacing the CPF with an identifier and keeping, in a controlled and secure environment, the table that links that identifier to the real CPF. The LGPD addresses pseudonymization in Article 13, in the context of public health studies, and the central point is this: pseudonymized data remains personal data and remains under the law. It is better protected, but it doesn't leave the game.

Translated to the day to day: pseudonymization is a security measure that reduces risk. Anonymization is a change in the category of the data. Whoever confuses the two usually promises the board a level of protection the dataset doesn't have.

One warning that most people ignore. Anonymization is not permanent by decree. It depends on the technical means available at the time. A dataset considered anonymous today can become re-identifiable tomorrow, when a new technique appears or when it is cross-referenced with another public dataset. If the data points to a person again, it becomes personal data again and the LGPD applies to it again.

How anonymization works in practice

There is no anonymize button. There is a set of techniques, and the choice depends on what you need to preserve in the analysis.

Suppression simply removes the field that identifies, such as deleting the CPF column. Generalization replaces the exact value with a range, turning the age 37 into "between 30 and 40 years old" or the full CEP into just the region. Masking scrambles or replaces part of the data, showing only the last digits of a document. Perturbation adds controlled statistical noise to the numbers, so that the total for the set remains reliable but no individual record matches reality. And there are more robust techniques, such as k-anonymity, which guarantees that each combination of attributes appears repeated in at least a minimum number of records, so that a row is never alone and identifiable.

What separates those who know from those who improvise is care with quasi-identifiers. Name and CPF are obvious. The danger is in the combination of seemingly harmless fields. Job title, city, salary band, and hire date, together, can point to a single person inside a company. Truly anonymizing means looking at the whole record, not just the document column.

Where this shows up in companies' day to day

Anyone who works with master data runs into this topic all the time, even without calling it by name.

The most common case is the test and staging environment. The company is going to test a new ERP version or a new report and copies the entire production database into the development environment. Suddenly, the real customer master, with name, document, and contact, is in a database that many people access and that almost never has the same level of protection as production. Anonymizing that copy before releasing it to the technical team solves the risk without blocking the work.

The second case is analysis and sharing. When the business area wants to study purchasing patterns, customer behavior, or supplier profiles, it rarely needs to know who the person is. It needs the pattern. An anonymized dataset delivers the analysis and eliminates the exposure. The same applies when the company hires an outside partner for a consulting project and needs to send data out.

The third case is artificial intelligence, and this one grows every day. Models are trained on large volumes of data, and training on raw personal data is taking on an enormous risk. Here comes a point I always repeat: anonymizing doesn't fix bad data. If the dataset is duplicated, with a supplier created three times and a customer spelled five different ways, you will anonymize the same error several times and train the model on protected mess. Privacy and quality are different layers, and neither replaces the other.

Which tools help

The market has options, and they usually live inside the quality, integration, and governance platforms that companies already use. Informatica offers static and dynamic data masking. Microsoft handles the topic within Purview and SQL Server, with data masking features. IBM has InfoSphere Optim for test data. Tools such as Delphix and K2view are strong at provisioning test environments that are already masked. In quality and governance, platforms like Ataccama bring protection features together with profiling and cleansing. And in the open world there are projects such as ARX, aimed specifically at statistical anonymization.

The tool matters, but it is the last step. Before it comes the decision about which data is sensitive, who can access what, and which technique fits each case. Without that definition, the tool only automates a choice nobody thought through properly.

The link to data governance

Anonymization looks like a security and legal subject, but it doesn't work without data governance underneath. To anonymize consistently, the company needs to know where personal data is, which fields are sensitive, who owns each database, and what the lifecycle of each piece of information is. That is data catalog, classification, data ownership, and policy. That is governance.

Anyone who has taken part in a serious project knows that the personal data inventory and the data dictionary are precisely what allow you to anonymize without breaking operations. Without that map, every anonymization becomes a project from scratch, done in a rush and usually incomplete. With governance, it becomes a repeatable process. It is the difference between reacting to a demand and being in control of your own data.

How to learn and specialize

Anonymization sits on the border between privacy, data quality, and governance, which is why it opens so many doors. A good path is to first master the fundamentals of data governance and data management, understand the LGPD in practice, learn the statistical anonymization techniques, and get to know the masking tools on the market. The body-of-knowledge reference for the field is the DAMA-DMBOK, and the CDMP certification, from DAMA, helps those who want to formalize that knowledge and grow in a data career.

What the market values is not memorizing the definition in the law. It is knowing how to look at a real dataset, identify the quasi-identifiers, choose the right technique, and explain to the board the risk that remains. That combination of technical vision and business vision is rare, and it is exactly what puts a professional ahead.

Main questions

Is anonymized data still personal data? No, as long as the anonymization is effective and doesn't allow the person to be re-identified. In that case, the data falls outside the scope of the LGPD. If it is possible to reverse it and get back to the data subject, it remains personal data.

Are anonymization and pseudonymization the same thing? No. Anonymization eliminates the path back to the person and aims to be irreversible. Pseudonymization keeps a separate key that allows re-identification, so the data remains personal and under the law.

Is anonymizing the same as encrypting? No. Encryption protects data in storage and in transit, but it is reversible for whoever has the key. Anonymization aims to make re-identification unfeasible, changing the nature of the data.

Is anonymization always final? No. It depends on the techniques available at the time. A dataset thought to be anonymous can become re-identifiable with new techniques or by cross-referencing other sources.

Do I need to anonymize before using data in AI? It is the recommended practice whenever the model doesn't need identified personal data. But remember that anonymizing doesn't improve the quality of the dataset. Bad data anonymized is still bad.

MDM Academy

MDM Academy is the data governance and master data school of 4MDG. It was created to train professionals who solve, in practice, the problems this article describes: a dataset exposed in a test environment, duplicate masters that hurt analysis, a lack of clear policy on sensitive data, and AI projects built on data nobody trusts. The focus is on joining concept and application, with content that translates the technical into business impact.

If you work with master record maintenance, procurement, supply chain, IT, or governance and want to turn experience into a career, it is worth getting to know MDM Academy and joining the Data Club, where the community exchanges real experience on these challenges every day.

Conclusion

Data anonymization is not a technical trick to escape the LGPD. It is a conscious decision to keep using the value of the information without carrying the risk of exposing people. Done well, it frees the company to test, analyze, and train models with peace of mind. Done halfway, it creates a false sense of security, which is usually worse than doing nothing.

And the message that matters is this: anonymization and quality go together, but they don't replace each other. There is no point in protecting a dataset nobody can trust. The company that treats privacy and governance as the same job, and not as separate tasks, is the one that truly gains control over its own data.