These terms are often used interchangeably. Under Quebec's Law 25, however, they have very different consequences.
De-identified (or pseudonymized)
Information is de-identified when it no longer allows the person to be identified directly, for example by replacing a name with a code.
Example: "Client 12345, female, 55, nut allergy."
The person is no longer named, but remains indirectly identifiable, notably through the code's lookup table. De-identified information is still personal information, and the business must take reasonable measures to limit re-identification risks.
Anonymized
Information is anonymized when it irreversibly no longer allows the person to be identified, directly or indirectly.
Example: "37% of our clients in the region reported a food allergy in 2025."
Law 25 allows anonymization instead of destruction once purposes are fulfilled, for serious and legitimate purposes. Since May 30, 2024, Quebec's Regulation respecting the anonymization of personal information governs the process: preliminary analysis, appropriate techniques, re-identification risk analysis and periodic reassessment.
Common techniques
- Removing direct identifiers (name, address, phone number).
- Pseudonymization: replacing with a code, with the key stored separately and protected.
- Aggregation: publishing totals or averages instead of individual data.
- Generalization: an age range instead of a date of birth.
- Adding noise or synthetic data for statistical analysis.
Encryption protects confidentiality but does not make information anonymous: with the key, it becomes readable again.
In practice
Before using data for analysis, an AI project or sharing, ask yourself: do I really need identifying information? Often, the answer is no. Minimizing reduces risk.
We help SMBs build these concepts into their practices. See privacy and governance. For legal interpretation, consult a lawyer.