Anonymisation: irreversibly de-identified, out of GDPR scope. Pseudonymisation: reversible, still personal data.
Anonymisation irreversibly removes the link between data and an identifiable individual; truly anonymised data falls outside GDPR scope. Pseudonymisation (GDPR Art. 4(5)) replaces identifying fields with pseudonyms but the link can be restored with separately held information — pseudonymised data remains personal data.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.