Anonymization vs Masking vs Pseudonymization: What Differs

In most organizations the sentence “we anonymized the data” describes one of three different operations, and the legal and operational consequences of those three are not interchangeable. A masked payroll table is still personal data. A pseudonymized patient list is still personal data. Only data that has genuinely been anonymized leaves that category. A retention and disposal process built without this distinction cannot support the claim “we disposed of it” when an auditor asks for proof.

Three concepts, three different outcomes

All three methods try to make the information about a person in a record invisible or unlinkable. They diverge on whether the result is reversible and whether the data still counts as personal data afterwards. Those two questions decide everything that follows: does the data stay in the inventory, does access control still apply, is the record searched for data subject requests, does the retention clock keep running.

The page on deletion, destruction and anonymization published by KVKK, Türkiye’s data protection authority, treats anonymization under the same heading as deletion and destruction, that is, as a disposal route. Anonymization is therefore not a concealment technique; it is a disposal method and carries the burden of proof that disposal methods carry. Masking and pseudonymization are not the subject of that page; they are security measures applied while processing continues.

This article is not legal advice; legal interpretation remains with the organization’s legal function.

Masking: hides the value, keeps the record

Masking replaces a sensitive value with a surrogate so that the record stays usable for its purpose while the original value is no longer visible. Showing only the last four digits of a national ID number (TCKN) or preserving the first six and last four digits of a card number are typical examples. The record still belongs to the person; the people looking at that field cannot see the real value.

The purpose of masking is not disposal. Its purpose is to shrink the exposure surface in situations where the data has to stay where it is. If a customer service team only needs the last digits of a TCKN to verify identity, the full value does not need to be on screen. If a production table is copied into a test environment, masked TCKN and IBAN columns keep developers away from real identity data.

Operationally, masking is a remediation action: it answers a finding, is assigned to an owner, is approved and is recorded. In Seratus, who performed the action, when and why is kept in the remediation and evidence flow. A masked record does not drop out of the inventory, and its retention period keeps running.

Pseudonymization: moves the link, does not cut it

Pseudonymization replaces the direct identifier with a token, key or random ID and stores the way back to the real identifier somewhere else. Replacing a patient’s name with “P-0417” in a research dataset and keeping the mapping table in a locked environment is the classic example.

It reduces the number of people who see identities, but the result remains personal data. As long as the mapping table or key exists, the person can be re-identified, so pseudonymized datasets stay in the inventory, remain subject to access control and have to be searched when a data subject request arrives.

Pseudonymization has two weak points. The first is the mapping table itself: it becomes one of the organization’s most sensitive assets and is usually forgotten after the initial design, left on a file share for years. The second is indirect identifiers: even with the name removed, the combination of birth date, postcode, hire date and job title points to a single person in most organizations.

Anonymization: the point of no return

Anonymization makes data impossible to associate with an identified or identifiable person, even when matched against other data. There is no way back; no mapping table is kept; indirect identifiers are generalized, suppressed or removed as well. The result loses its character as personal data, which is why it is accepted as a disposal method.

The critical point is that the claim of irreversibility has to be proven. Deleting direct identifiers is not anonymization; you have to measure whether the remaining fields, in combination, still reach the person. Remove name, TCKN and IBAN from a payroll table and the quartet “department, title, hire year, gross salary” still identifies one person in most organizations. Until that quartet is generalized (salary into bands, hire year into five-year ranges), the set is not anonymous.

The second half of an anonymization decision is the disposal of the original. An organization that produces an anonymous copy and keeps the original has not disposed of anything; it has produced a derivative. Seratus therefore treats anonymization not as one operation but as a three-step flow: producing the redacted copy, measuring its quality with a uniqueness check, and disposing of the original with approval. That flow is tied to the retention calendar in the KVKK compliance module.

Comparison table

Criterion	Masking	Pseudonymization	Anonymization
Reversible	No for the masked field, but the record stays linked to the person	Yes, with the key or mapping table	No
Result is personal data	Yes	Yes	No
Stays in the inventory	Yes	Yes, including the mapping table	No
Searched for data subject requests	Yes	Yes	No
Retention clock keeps running	Yes	Yes	Not applicable
Typical use	Screens, reports, test environments	Research, analytics, external service providers	Expired retention, statistics
Quality measure	Completeness of masked fields	Protection of the key, indirect identifier check	Uniqueness check, irreversibility
Evidence required	Action record	Action record and key access log	Quality measurement, disposal record for the original, approval chain

Which one, when

If the data is still needed for a live business process and the goal is only to narrow who sees it, masking is the right choice. Example: at an insurance company, the TCKN field on the policy support screen is shown masked to the customer service role and in full to the collections role. That is an access design decision, not a disposal decision.

If the data is going to another team or outside the organization for analysis or research and a route back to the identity is needed later (for example, feeding a clinical result back to the patient), pseudonymization is the right choice. The mapping table then enters the inventory as an asset in its own right, with its own access restrictions.

If the retention period has expired, or the data will only be kept for aggregate statistics, anonymization is the right choice. A retailer converts the purchase history of customer accounts closed five years ago into an anonymized copy for campaign analysis and disposes of the originals. Masking is insufficient here: a masked record is still personal data held past its retention period.

It is normal for an organization to apply all three methods to the same dataset at different moments. What matters is knowing which method was applied when, and keeping a record of each.

How quality is measured

For masking the measure is simple: were all the fields that needed masking masked, is the format consistent, and does an unmasked copy survive somewhere else. The last question is the one most often neglected. If the production table is masked but an export taken a week earlier still sits on a share, masking is incomplete. A masking decision should therefore always be taken together with discovery.

For pseudonymization quality has two dimensions: is access to the mapping table genuinely limited, and do the indirect identifiers allow uniqueness. The second dimension uses the same technique as the anonymization measurement.

For anonymization the measure is the uniqueness check. For every row in the redacted copy, count how many rows share the same combination of remaining fields. Combinations that appear in a single row potentially point to one person. Those combinations are generalized or suppressed and the measurement is repeated. Seratus runs this check on every redacted copy and stores the result as part of the disposal record, so that in an audit the organization can present the measurement itself.

Common mistakes

Most recurring mistakes come from missing operations rather than conceptual confusion. The ones seen most often:

• Labelling a pseudonymized set “anonymous” and dropping it from the inventory. As long as the mapping table exists, the set is personal data.
• Removing only direct identifiers and calling it anonymization. Without measuring indirect identifiers, the set is not anonymous.
• Producing an anonymous copy and keeping the original. That is duplication, not disposal.
• Masking the production table and forgetting old exports, backups and test copies. Masking applied to one copy of the data does not reduce the risk.
• Leaving the mapping table on a file share or a developer’s local disk.
• Recording none of it. Without a record, no method can be defended in an audit.

In each case the method was chosen before anyone knew where the data was. Any method applied without data classification and discovery is applied to the known copy; the unknown copy stays as it was.

How Seratus closes these gaps

Gap: unknown copies of the same value. Masking or anonymization is applied only to the known table; exports, backups and test environments stay outside. Seratus agentless discovery finds the same value across file servers, Microsoft 365, databases, object storage and mail archives, so the remediation decision covers every copy.

Gap: pseudonymized sets and mapping tables outside the inventory. In the Seratus classification taxonomy these sets are tagged as personal data, enter the VERBİS inventory from real discovery, and who can reach the mapping table is visible in the access and exposure graph.

Gap: anonymization quality never measured. After producing the redacted copy, Seratus runs the uniqueness check and stores the result. Disposal of the original is not approved without the measurement.

Gap: anonymous copy produced, original retained. In Seratus the anonymization flow is completed by disposal of the original; disposal is a separate approval right, and a second approver can be required.

Gap: the method is not recorded. Each masking, pseudonymization and anonymization action is written to the audit log with who, when and why, and exported in the KVKK readiness summary and audit report as PDF, Excel or CSV.

Gap: the wrong method for expired data. The Seratus retention calendar lists data past its retention period as a “gap” and starts the disposal or anonymization flow; masking does not close that gap and is not shown as if it did.

Takeaway

Masking reduces risk, pseudonymization reduces the number of people who see identities, anonymization ends the data’s status as personal data. The three answer different questions, and only the last is a disposal method. What an organization has to do is decide, for every dataset, which method applies at which moment, find every copy of the data before applying it, and record each step together with its measurement. When those three things are in place, “we anonymized it” stops being a claim and becomes a provable operation.