Replacing the names in a file with aliases before giving it to an AI does not make it anonymous: it is pseudonymisation, and pseudonymised data that can be attributed to a person remain personal data (GDPR, Recital 26). Anonymisation requires identification to be impossible in practice and irreversible.
The CNIL (the French data protection authority) defines anonymisation as processing that consists in using a set of techniques so as to make any identification of the person impossible in practice, by any means whatsoever, and irreversibly (CNIL, Anonymisation of personal data). Truly anonymous data fall outside the scope of the GDPR.
Pseudonymisation is something else. Article 4(5) of the GDPR defines it as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures (GDPR, Chapter 1, on the CNIL website). In practice, according to the CNIL, it consists in replacing directly identifying data (surname, first name) with indirectly identifying data (alias, sequential number).
| Anonymisation | Pseudonymisation | |
|---|---|---|
| What it does | Makes identification impossible in practice | Replaces direct identifiers with aliases or numbers |
| Reversible? | No | Yes, with the additional information |
| Status of the data | Outside the scope of the GDPR, for the entities with regard to which they are anonymous | Personal data, for whoever can attribute them to the person and, according to the draft guidelines of the European Data Protection Board (EDPB), for whoever processes them on its behalf |
Recital 26 of the GDPR says so expressly: personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information, should be considered to be information on an identifiable natural person. The law firm that keeps the table matching the aliases to its clients is therefore processing personal data. And the provider of the tool that processes this file on the firm's behalf cannot judge the matter from its own standpoint alone: the EDPB draft guidelines discussed below state that, for an entity processing information on behalf of a controller, whether the data are personal is assessed from the controller's point of view; they should then be considered personal data for that entity too, and the entity a processor within the meaning of the GDPR.
The CNIL gives an example: a database of CVs in which only a person's surname and first names have been replaced by a number that corresponds to that person alone still makes it possible to single that person out, and remains pseudonymised, not anonymised. It adds, regarding pseudonymisation, that in practice people's identity can be recovered using third-party data.
A litigation file can fall into this category. Under Article 4(1) of the GDPR, a person is identifiable where they can be identified, directly or indirectly, in particular by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Yet the file of a victim or of an employee contains factors of this kind, such as the injuries described by the expert, the employer, the job held or the family composition, and others that make it possible to link it to third-party data, such as the date and place of the accident. Once the name is removed, they remain.
To check that a dataset is truly anonymous, the European data protection authorities apply three criteria, which the CNIL adopts:
Where these three criteria are not perfectly met, the CNIL requires a thorough assessment demonstrating that the risk of identification is negligible. To build an anonymisation process, the CNIL advises in particular removing direct identifiers as well as rare values, and describes techniques such as generalisation, for example replacing a date of birth with the year alone.
On 7 July 2026, the European Data Protection Board (EDPB) adopted guidelines on anonymisation, submitted to public consultation until 30 October 2026 (press release translated by the CNIL). They take into account the judgment of the Court of Justice of the European Union of 4 September 2025 (Case C-413/23 P, EDPS v SRB, European Data Protection Supervisor v Single Resolution Board).
Three points stand out from the press release:
As the text is under consultation, its final version may still change.
In personal injury, the file contains health data, which Article 4(15) of the GDPR defines as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. Article 9 of the GDPR prohibits the processing of such data, except in the cases it lists, among them processing that is necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f)).
On hosting and professional secrecy, see also our article on AI, professional secrecy and sovereignty.
Pseudonymisation is not useless. The GDPR cites it among the measures for data protection by design (Article 25) and among the security measures that the controller and the processor implement according to the risks (Article 32). The CNIL presents it as one of the measures recommended by the GDPR to limit the risks linked to the processing of personal data.
It does not, however, exempt the firm from its other obligations. Where processing is carried out on the firm's behalf, Article 28 of the GDPR requires it to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures. The question of the lawyer's professional secrecy (secret professionnel), which covers all the exhibits in the file (article 66-5 of the Law of 31 December 1971), arises separately: we cover it in our article on AI and professional secrecy.
The firm therefore has two options. The first is to remove from the file everything that makes it possible to identify the person, at the risk of also removing the facts on which the valuation depends: the date of stabilisation (consolidation), age, the after-effects described, pay. The second is to process the complete file in an environment designed for this type of data.
Plato, the AI specialised in personal injury, which is extending into employment law, has made the second choice: HDS hosting in France, AES-256 encryption, data never used to train models, and full traceability, with every figure tracing back to the exhibit it comes from. Choosing a tool is also a question of reliability: see our article on verifying case law cited by an AI and our criteria for choosing valuation software.
What is the difference between anonymisation and pseudonymisation?
Anonymisation makes identifying the person impossible in practice and irreversibly; truly anonymous data fall outside the scope of the GDPR. Pseudonymisation replaces direct identifiers with aliases, reversibly: the data remain personal for whoever can attribute them to the person.
Is replacing the client's name with an alias enough to anonymise a file?
No. It is pseudonymisation. The CNIL points out that a dataset in which only the names have been replaced by an identifier specific to each person still makes it possible to single that person out, and that identity can be recovered using third-party data.
Are pseudonymised data still subject to the GDPR?
Yes, for whoever can attribute them to the person. Recital 26 of the GDPR provides that pseudonymised data which could be attributed to a person by the use of additional information relate to an identifiable person. According to the EDPB draft guidelines of 2026, they should also remain so for the provider that processes them on the firm's behalf.
What are the three criteria for successful anonymisation?
Singling out (impossible to isolate an individual), linkability (impossible to link datasets concerning the same individual) and inference (impossible to deduce new information about an individual). Where they are not perfectly met, the CNIL requires a thorough assessment demonstrating that the risk of identification is negligible.
What is the status of the health data in a personal injury file?
They are special-category data, the processing of which Article 9 of the GDPR prohibits except in the cases it lists, among them processing that is necessary for the establishment, exercise or defence of legal claims.
What do the EDPB's 2026 guidelines on anonymisation change?
Adopted on 7 July 2026 and under public consultation until 30 October 2026, they specify that whether data are anonymous may vary from one entity to another and propose a contextual or simplified approach, while keeping the three criteria of singling out, linkability and inference.