Pseudonymization and anonymization are two data protection terms. Pseudonymized data, for example with a participant ID, remain personal data under the GDPR (EU data protection law) because a separately stored key allows attribution. Data are anonymous only if the link to a person can no longer be established.
- Definition and legal basis
- Pseudonymized is not anonymous
- Which data arise in a usability study
- When study data remain identifiable
- The study lifecycle from recruitment to deletion
- Raw data, results report and handover to the client
- Classification and limits of this presentation
- Frequently asked questions (FAQ)
Definition and legal basis
Pseudonymization and anonymization are two terms of data protection law that come up constantly in usability studies with participants and are often confused. Anyone who collects video, audio, screen recordings, notes and participant lists needs to know which of these data still count as personal data after processing. This article classifies the terms along the course of a study.
The GDPR (General Data Protection Regulation, the EU data protection law; Regulation (EU) 2016/679) defines pseudonymization in Art. 4(5) as the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information. This requires that the additional information is kept separately and is subject to technical and organizational measures that prevent attribution. In a study, this corresponds to a participant ID instead of the name, as long as the key that links IDs to persons is stored separately and protected.
The GDPR does not define anonymization in an article of its own. Recital 26 (the explanatory part of the regulation) describes anonymous information as information that does not relate to an identified or identifiable natural person, and as personal data that has been rendered anonymous in such a manner that the data subject is not or no longer identifiable. The principles of data protection do not apply to such data.
Pseudonymized is not anonymous
The decisive difference lies in traceability. According to Recital 26, pseudonymized data that could be attributed to a person by the use of additional information are information on an identifiable natural person. Pseudonymized data therefore remain personal data. In its Guidelines 01/2025, the European Data Protection Board (EDPB) additionally states that this also applies if the data and the additional information are not held by the same party. Even if all additional information has been deleted, the data count as anonymous only if the conditions of anonymity are met.
On the question of whether a person is identifiable, Recital 26 names a yardstick: account is to be taken of all the means reasonably likely to be used by the controller (the party that decides on the purposes and means of the processing) or by another person to identify the person directly or indirectly. Objective factors such as the costs and the amount of time required for identification and the technology available at the time of the processing must be considered. Anonymity is therefore not a property that is assigned to a dataset once, but the result of an assessment against this yardstick.
The former Article 29 Working Party, the predecessor body of the EDPB, reached the same conclusion in its Opinion 5/2014: pseudonymization is not an anonymization technique but merely reduces the linkability of a dataset with the identity of a person. Pseudonymized data still allowed individuals to be singled out and datasets to be linked. The opinion was written under Directive 95/46/EC, but its substance matches the current reading of Recital 26.
Which data arise in a usability study
For the classification, it helps to look at the individual types of data in a study. The types differ in how easily they can be detached from the person:
- Participant list with names, contact details, occupation and employer: directly identifying, does not belong in the analysis data.
- Key that links participant IDs to persons: according to the EDPB, it can itself be personal data and must be protected separately.
- Video recording: face and surroundings can be features by which a person can be identified.
- Audio track: voice, but also names, employers or wards that are mentioned.
- Screen recording: accounts, names or file paths that are displayed, depending on the test environment.
- Observer notes and transcripts: quotes, occupational details and particulars that allow conclusions to be drawn.
Art. 4(1) GDPR names, as examples of identifying features, a name, an identification number and factors specific to the physical identity of a person, among others. A participant ID replaces only the name. All other features remain in the data unless they are removed or altered.
When study data remain identifiable
There are three typical pitfalls in usability studies. First, face and voice in a recording cannot be replaced by an ID. A recording with the file name P07 is pseudonymized but not anonymous as long as the person is recognizable in it. Whether methods such as blurring or voice alteration actually rule out identifiability must be assessed case by case against the yardstick of Recital 26.
Second, small samples make it easier to single out a person. Opinion 5/2014 describes singling out as the possibility of isolating some or all records in a dataset that identify an individual. If only one participant in a study has a certain role, that information alone is already an identifying feature.
Third, rare occupational groups, specialties or sites of use act like a fingerprint. The description “senior physician of a certain specialty at a hospital in a certain region” can be enough to name a person, even without a name. The EDPB also points out that additional information can lie outside the control of the controller, for example in publicly accessible sources such as social network posts, and must be taken into account when testing effectiveness, to the extent that it is reasonably available.
The study lifecycle from recruitment to deletion
Pseudonymization is not a one-time action at the end but a process that accompanies the entire course of a study. The GDPR names it in Art. 25(1) and Art. 32(1)(a) as an example of appropriate technical and organizational measures. For the course of a study, this results in the following approach, which is based on our own professional derivation:
- Recruitment: collect only the information needed for selection. Keep contact details separate from the study data and assign each participant an ID early. For building the sample, see Representative users and Intended user.
- Conduct: use only the ID in recordings, file names and notes, do not let names and employers be spoken aloud in the session, and prepare screens without real names. This applies to formative as well as summative studies.
- Analysis: analyze using IDs only, grant access by role, and keep the key in a separate location. With methods such as the think-aloud method, many statements arise in raw form and must be checked before they are passed on.
- Handover: pass on only what the client needs for the purpose (see the next section).
- Deletion: under Art. 5(1)(e) GDPR, data may be kept in identifiable form only as long as necessary for the purposes. Retention periods for raw data and key are set before the study begins.
Deleting the key alone does not automatically make the data anonymous. The EDPB clarifies that data are anonymous only if the conditions of anonymity are met, even then. A deleted key does not remove face, voice and occupational details from the recordings.
Raw data, results report and handover to the client
There is an important difference between raw data and the results report. Raw data, that is, recordings, transcripts and notes, generally remain personal data and stay with the party conducting the study. The results report, by contrast, can be limited to participant IDs and group characteristics, for example role, experience level or frequency of use. Individual details that allow conclusions about a person do not belong in it, such as hospital, city or exact specialty in combination with a quote.
For passing on pseudonymized data, the EDPB names several points to check. First, at least the recipient’s means of attribution are to be determined and taken into account. In addition, following the principle of data minimization, it is to be checked whether the pseudonyms need to be transmitted at all. If there is no reason for it, they should not be transmitted. The key itself can also be personal data and therefore generally stays with the party conducting the study.
Video clips and quotes are the most common point of dispute. Anyone who wants to give excerpts to the client should define this in advance and tell the participants in the participant information. For approval documents such as the HFE/UE report, participant IDs and group profiles are, in our assessment, generally sufficient. For placing the study in the approval process, see human factors validation testing.
Classification and limits of this presentation
This article is a professional classification, not legal advice. Whether data count as anonymous in a specific project, which legal basis supports the processing and which information obligations apply must be clarified case by case, if necessary with the data protection officer. Consent and participant information are a topic of their own and are mentioned here only in passing.
For this presentation, the EDPB Guidelines 01/2025 were available in the version for public consultation adopted on January 16, 2025 (as of November 2026). A later final version was not reviewed and should be checked before application.
Pseudonymization replaces identifying features with an identifier, for example a participant ID, and keeps the key separately. Under Art. 4(5) and Recital 26 GDPR, pseudonymized data remain personal data.
Data are anonymous only if the person can no longer be identified, not even by means reasonably likely to be used. In recordings with face and voice, with small samples and with rare occupational groups, this is hard to achieve.
Over the course of a study from recruitment to deletion, this means: assign IDs early, keep the key separate, limit reports to group characteristics and pass on only what the client needs.
Frequently asked questions (FAQ)
Are pseudonymized study data still personal data?
Yes. Under Recital 26 GDPR, pseudonymized data that could be attributed to a person by the use of additional information count as information on an identifiable person. According to the EDPB Guidelines 01/2025, this also applies if the additional information is held by another party.
When are study data anonymous?
When the data no longer relate to an identified or identifiable person or the person can no longer be identified. Under Recital 26, the yardstick is all means reasonably likely to be used for identification, including costs, time required and available technology. In recordings with face and voice, this is hard to achieve.
Does deleting the key make the data anonymous?
Not automatically. The EDPB states that pseudonymized data count as anonymous even after all additional information has been deleted only if the conditions of anonymity are met. Features in the data themselves, such as face, voice or rare occupational details, remain.
May recordings and the key be passed on to the client?
That depends on the purpose and on the prior agreement with the participants and must be clarified case by case. Professionally, the key generally stays with the party conducting the study, and only what the client needs for the purpose goes to the client. The EDPB recommends checking, before pseudonymized data are transmitted, whether the pseudonyms are needed at all.
Are you planning a usability study with participants? We support you with recruitment, conduct and documentation, so that recordings and participant data are cleanly separated and protected from the start.
More about our usability engineeringSources
- Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Art. 4, 5, 6, 7, 9, 12, 13, 17, 25, 32 and Recitals 26, 32, 42, 43
- EDPB, Guidelines 01/2025 on Pseudonymisation, version for public consultation, adopted on January 16, 2025
- Article 29 Data Protection Working Party, Opinion 05/2014 on Anonymisation Techniques (WP216), adopted on April 10, 2014