Pseudonymization vs anonymization in clinical research

GDPR Article 4(5) defines pseudonymisation as processing personal data so that it can no longer be attributed to a specific individual without additional information, provided that the additional information is kept separately and is subject to technical and organisational measures that prevent attribution. The key point is that the additional information still exists. Recital 26 says that pseudonymised data which could be attributed to a person by using additional information should be considered information on an identifiable natural person.

The same recital describes anonymous information as information that does not relate to an identified or identifiable person, or personal data rendered anonymous so that the person is not or no longer identifiable. To decide whether someone is identifiable, you should take into account all the means reasonably likely to be used, such as singling out, either by the controller or by another person, with objective factors like cost, time and available technology.

In practice that gives us a spectrum. Identified data carries names. Pseudonymised data carries codes and a key exists. Anonymous data has no key and has passed a realistic re-identification test. Data in between, such as a dataset with the key destroyed but unusual combinations still in it, is the difficult zone, and regulators have repeatedly warned that removing the key does not by itself make data anonymous. Our page on pseudonymization of trial data in an EDC shows how Capture implements the pseudonymised state. This page is about the concept and the decision.

Two sources moved the discussion in 2025. First, the European Data Protection Board adopted Guidelines 01/2025 on pseudonymisation on 16 January 2025 and consulted until 28 February 2025. The draft says pseudonymised data remains personal data and that pseudonymisation is a risk-reduction measure that supports principles such as data minimisation and security (Articles 5, 25 and 32), not a route out of GDPR. The EDPB lists a final version after consultation, but we could not confirm its date or any changes, so check the current text.

Second, on 4 September 2025 the Court of Justice decided EDPS v SRB (C-413/23 P). As described by law-firm and privacy-forum summaries we found, the Court said identifiability is to be assessed from the perspective of the party processing the data, in context, considering the means reasonably likely to be used. On that reading pseudonymised data is not automatically personal data for every recipient who receives it, although the original controller still has its transparency duties. Commentators noted that this sits uneasily with the EDPB's more absolute draft position.

What does that mean for a trial? Not much for the site and the sponsor: the party who holds, or can lawfully obtain, the key is still processing personal data. It may matter for onward sharing, for example sending a coded dataset to an independent analyst who has no means to obtain the key. Even then, take advice, because the analysis turns on facts, and because the EDPB, national regulators and ethics committees may not follow a narrow reading. Until the guidance settles, the cautious approach is to treat coded clinical data as personal data in every contract and consent form.

Capture supports the pseudonymised state: participants get coded study IDs with site-level numbering, site coordinators see names while researchers see coded IDs, and row-level security at the database layer enforces the split. Roles are researcher, site coordinator and admin. The audit trail is field-level and clinical data is soft-deleted only. Exports can be filtered by date range and by site and include an automatic data dictionary. Data is hosted in the EU (Frankfurt) or the USA (N. Virginia).

Capture does not claim anonymisation, and it does not state that its exports are anonymised. Free-text fields, dates and rare combinations can still identify someone, and the review described above is yours. For the control-by-control view, read data pseudonymization in EDC. For role design, read role-based access control for clinical trials.