Anonymisation vs Pseudonymisation of Patient Data in Case Reports: What GDPR and the EDPB’s 2025 Guidelines Mean for Authors

The detail that makes a case report useful, such as a rare diagnosis, a precise timeline or a photograph, can also make the patient recognisable. Practice is uneven: in a meta-research study of 2,053 case reports and case series published in 2021, informed consent was reported in 79% and an ethics committee statement in only 46% [1]. For authors in Europe the question is also legal. This article explains anonymisation vs pseudonymisation under the General Data Protection Regulation (GDPR), what the EDPB 2025 guidelines and later guidance changed, and what to do before submission. It is general guidance, not legal advice.

GDPR applies to personal data: information about an identified or identifiable person. Health data are special category data under Article 9. Article 4(5) defines pseudonymisation as processing data so that they can no longer be attributed to a person without additional information, which is kept separately and protected; Recital 26 places anonymous information, where the person is not or no longer identifiable, outside the Regulation [6].

The practical difference is reversibility. Pseudonymised data can be linked back to the patient by whoever holds the key, so they remain personal data for that party. The European Data Protection Board (EDPB) confirms this and requires the additional information to be kept apart under technical and organisational safeguards [2]. Table 1 compares the two.

On 16 January 2025 the EDPB adopted Guidelines 01/2025 on pseudonymisation for public consultation; no final version had been published by October 2026. They explain how to transform identifiers, keep additional information separate and define a “pseudonymisation domain”: the people who should only ever see the pseudonymised data [2].

On 4 September 2025 the Court of Justice ruled in EDPS v SRB (C-413/23 P) that pseudonymised data are not necessarily personal data for every recipient. The case concerned the regulation for EU institutions, whose definitions mirror the GDPR’s. Where a recipient cannot re-identify the person by means reasonably likely to be used, the data may not be personal data for that recipient, although the controller’s obligations still apply [7].

In July 2026 the EDPB published draft EDPB anonymisation guidelines 2026 (Guidelines 02/2026), with consultation open until 30 October 2026. They update the 2014 Article 29 Working Party opinion on anonymisation techniques and take a contextual approach, assessing anonymity from the perspective of each party with realistic access to the data [8]. Check the adopted version before relying on its detail.

For a GDPR case report, this cuts both ways. A published report reaches the patient’s family, colleagues and community, who may hold “additional information” of their own. In our view, a report is anonymous only when no reasonably likely reader could identify the patient, a high bar for rare conditions.

Removing the name is not enough. Patients can be identified through direct identifiers and through combinations of indirect identifiers that are harmless alone (Table 2). The rarer the condition, the more each remaining detail narrows the pool of possible patients, so treat every report as identifiable unless you can document why it is not.

Good de-identification of patient data also covers supplementary files, legends, footnotes and file names, where identifiers often survive.

Patient images are the hardest element to de-identify. A scoping review of 30 studies on publishing patient photographs found that masking the eyes with a black bar was the most common technique, and in one included study 87% of images were inadequately concealed [3]. Scans carry re-identification risk. In a study of 157 volunteers, face recognition matched about 97% of original MRI scans to the person’s photograph, and 28% to 38% after popular de-facing software (Figure 2) [4].

Journal policies vary. Among the top 50 dermatology journals, 88% required consent to publish patient images, but only 36% limited that requirement to recognisable images, while 48% applied it to all images [5]. Assume any image needs consent, and strip embedded metadata and labels from radiology and pathology files.

Because full anonymisation is rarely achievable, written informed consent for publication is the safeguard most journals rely on. In the 2021 sample, consent came from the patient in 74% of articles, from parents in 6% and from a guardian or next of kin in 5.9%; the most common wording was written consent to publish the article and accompanying images (Figure 3) [1].

Consent forms should be honest about limits. Among dermatology journals that published their forms, 59% stated that anonymity cannot be guaranteed and 77% mentioned dissemination beyond print, such as online and social media [5]. Explain what will be published, where, and that people who know the patient may still recognise them; honesty here protects patient privacy.

GDPR does not apply to the data of deceased persons (Recital 27), but member states may set their own rules [6], and journals usually still expect next-of-kin consent. Where a patient cannot be traced or lacks capacity, follow journal and institutional policy and record the decision. Our guide to GDPR Article 9 and manuscript editing covers sharing identifiable data with editors and AI tools.

Use Table 3 before submitting any case report that includes patient data. If the data are pseudonymised rather than anonymous, GDPR still applies to the authors and their institution: keep the additional information within a defined group, protect it with access controls and never send it to the journal [2]. For UK approvals, see whether case reports need ethics approval in the UK.

For most case reports, true anonymisation under GDPR is hard to achieve, because a published report reaches readers who may already know the patient. Pseudonymisation reduces risk but keeps the data within the Regulation. The 2025 guidelines, the EDPS v SRB judgment and the 2026 draft all point to a context-dependent test of identifiability. Good data protection in practice means minimising and generalising details, treating images as high risk, obtaining written consent and documenting each decision.