Pseudonymization vs. Anonymization: Hashing or encryption alone does not anonymize if re-identification remains possible. Only irreversibly unlinkable data falls outside the GDPR.