Does masking names make a document anonymous?

Date: 8 November 2026. Author: Riducta Editorial Team. Publisher: X20 Digital Trust Services S.r.l.

No: replacing names is insufficient to declare a document anonymous. A person may remain identifiable through context or additional information, such as a map connecting labels with original data. Masking can help reduce exposure before using text with AI, but the result must be assessed as a whole.

The distinction changes how work should be organised. Reversible text requires protection of the information enabling restoration. Text without names may still contain confidential information. This guide offers general criteria for recognising these situations, without legally classifying a particular dataset or certifying its anonymisation.

Separate the technical operation from the legal conclusion

In operational language, masking means covering or replacing information. The term alone does not describe all requirements of a protective measure. Replacing “Mario” with PERSON_A while retaining the correspondence is a reversible operation. Understanding its effects requires examining who holds the map, how it is protected and what remains in the text.

Article 4(5) of Regulation (EU) 2016/679 of 27 April 2016 defines pseudonymisation by reference to data that cannot be attributed to a specific individual without additional information, kept separately and subject to appropriate measures. Recital 26 requires consideration of reasonably likely means of identification. Source: GDPR.

Renaming a folder “anonymous” is therefore insufficient. The European Commission explains that pseudonymised data still usable to identify a person remain personal data in its guide to the application of the GDPR. Classification requires attention to context and the parties involved, rather than merely the absence of an identity field.

View the document as the recipient will

Ask what information the recipient may already know. A sentence describing the only manager at a small branch may identify someone without naming them. A precise date connected with a public event may have the same effect. Removing an address while retaining a detailed account of a known incident may do little to reduce the actual risk.

Consider other documents to be shared too. A stable label appearing in several files may allow information to be connected even though each separate item seemed insignificant. The check should cover material sent together and its intended use, rather than just the current page. If you do not know the recipient's context, record that uncertainty instead of assuming they know nothing.

Decide whether restoration is actually needed

When correcting a communication's style, restoring names afterwards may be useful. For a general explanation, no map may be necessary. Define the need before creating new correspondence records. Every additional map copy increases the information requiring management and protection.

Where restoration is necessary, restrict map access and keep it separate from shared material. Do not include it in the same message or AI conversation. If saving it in a file, use an organisation-approved location and check who can open it. Separation requires more than assigning different names to files available through the same public link.

Preserve the text's meaning

Use consistent labels and check later references. An incorrect substitution may attribute one party's obligations to another. Generalising a date may also distort the result if the question specifically concerns a contractual deadline. When a detail is necessary, consider using an invented example preserving the problem's structure instead of transferring the complete real situation.

An automatic detector supports the work, but does not necessarily know the organisational chart, public incidents or every nickname appearing in a document. Human review should look for what the system may miss. No warnings does not prove anonymity. The EDPB website expressly distinguishes pseudonymisation and anonymisation.

A fictional example

A company wants to summarise an internal report. It replaces names with EMPLOYEE_A and MANAGER_B but retains a reference to the only night shift in a small department and an exactly dated meeting. Someone familiar with the department could recognise the individuals. The company decides against sending that text to an external service and prepares a synthetic example without incident-specific details.

For a different task concerning a letter's wording, it instead uses reversible labels and retains the map separately. The cases require different choices because the purpose and necessary content differ. The example does not determine whether the first document was anonymous for every possible recipient: it demonstrates why counting removed names is insufficient.

Verify the result before and after use

Read the exported text again, including headings and file references. After receiving an answer, check that AI has not added information or reconstructed inappropriate associations. Before distributing the restored result, verify each label and limit disclosure to authorised people. The final document may also contain personal data even though it originated from a masked copy.

Record unresolved questions during this review rather than assuming a successful replacement resolves them. A colleague continuing the task should understand whether the material is a synthetic example, a reversible working copy or a document whose identifiability still needs assessment. These descriptions support a more accurate handover without making a legal promise about the data.

To explore a browser-based masking and restoration workflow, read about Riducta.