Anonymised Feels Comfortable. It Is Not.

Strip the names. Hash the emails. Resequence the keys. Call it anonymised. Everyone exhales.

It is not anonymised.

Legal and security want to feel comfortable. Engineering wants to ship. Someone proposes the ritual. Drop the obvious columns. The row becomes customer_18402 instead of a person. The model gets the table. The committee gets a slide that looks abstract.

It is pseudonymised, and often not even that.

GDPR is explicit. Data is anonymous only if the person cannot be identified by any means reasonably likely to be used, including by the controller, with additional information. ^[1] Pseudonymisation is still personal data. A shuffled ID that you can join back, or that a reasonably motivated party can join back with a leak, a device graph, a timestamp, a postcode, a rare condition, or last quarter's "anonymous" extract, is still a person.

This is not a theoretical gotcha. Re-identification from sparse demographics is an old result. Modern work only made it cheaper. ^[2] Quasi-identifiers survive the ritual. Embeddings of "anonymised" free text still encode the story. An LLM given the dump will reconstruct the person you thought you deleted, especially if it can also see the public web, the CRM notes, or the previous extract you forgot to rotate.

Comfort is not a lawful basis. Feeling that the spreadsheet looks abstract is not a DPIA. If you can still ask "what did this customer do" and get a biography, you are processing personal data. The sequence of the IDs changed the slide. It did not change the person.

Worse: the ritual trains the organisation to stop thinking. Once the file is labelled safe, nobody logs the query, nobody bounds the purpose, nobody notices the model is now a processing activity that can infer special-category data from the residue. You industrialised access and retired the only people who used to worry.

Europe is not the veto

Europe does not forbid a team talking to the estate. It forbids pretending you did it by shuffling the IDs. The ticket queue was a rationing system. The taxonomy is how the world is named. Graph and vector are the tools. This note is the lie in the middle.

What holds is narrower than a platform strategy, and harder than a memo.

• Split the paths. Exploration on aggregates, synthetic twins, or fields that cannot reasonably identify. Identified compute on a sealed path with a named purpose, a named human, and a log.
• Put the permission on the tool. The model should not have to be trustworthy. The call should know who is asking, for which purpose, in which jurisdiction, over which fields, and whether the answer may leave the room.
• Keep the compute where the people are. EU residency is not a vibe. If the plant cannot call the API, you already know this pattern. Air-gapped sites made the same point with heavier physics.
• Log the question. Who asked, which tool, which fields, which purpose, what came back, how long it lives. That is the analytics version of decision provenance. If you cannot unlearn a bad extract, you should not have made it.
• Do not confuse hashing with deletion. Rotating keys, suppressing rare grains, withholding free text, and refusing joins that reassemble a person are engineering. Renaming the primary key is theatre.

None of this puts the analyst back in the queue. It is the condition under which you can let them talk.

The costume

The companies that will not get there treat GDPR as a costume. They shuffle IDs, paste a comfort memo, and hand a frontier model the biography of every European they touch. They feel modern until the first reconstruction, the first cross-border surprise, or the first regulator who can read Recital 26.

Give them the estate. Put the permission on the tool. Stop pretending the sequence of the keys was ever the hard part.

It feels safe. It is not. A resequenced identifier is still a person if anyone, including you, can put the biography back together. The team should talk to the data. The tool should know which people they are allowed to see.

Related: The Ticket Queue Was a Rationing System, Share the Taxonomy or Do Not Bother, and Graph and Vector Are Tools, Not a Religion.