Data Protection

Anonymization

The irreversible process of altering data so individuals cannot be identified directly or indirectly.

How the laws define this

Regulators broadly agree that anonymization is a technical or procedural transformation of personal data designed to prevent the identification or re-identification of individual data subjects. Through these rules, the core aim is rendering information non-identifiable, whether to remove data from statutory obligations under Law No. 21.719 or safeguard inputs to third-party IAGen systems under Resolución 4/2025. However, rules diverge on whether anonymization must be absolute. Law 25 explicitly defines it as an irreversible process, and Order No. 90/NQ requires irreversibly preventing identification. Conversely, Law No. 21.719 and Resolución 4/2025 require only that individuals cannot be identified by means reasonably likely to be used. Differing from both, Қазақстан Республикасының «Дербес деректер және оларды қорғау туралы» Заңы defines anonymization merely as modifying data so it cannot be attributed to a subject without additional information.

Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Quebec, Canada	An Act to modernize legislative provisions as regards the protection of personal information (Law 25)	In Force (Amended)	Adds that anonymized data cannot be re-identified and explicitly allows retention for serious and legitimate purposes.
Argentina	Resolution 4/2025 – Guidelines for the Use of Generative Artificial Intelligence in Public Administration (Province of Buenos Aires, Subsecretariat of Digital Government)	In Force	Specifies use as a required safeguard before inputting sensitive or personal information into third-party generative AI systems.
Kazakhstan	Law of the Republic of Kazakhstan 'On Personal Data and their Protection'	In Force (Amended)	Limits anonymization to modifying data so it cannot be attributed without additional information, omitting irreversibility.
Chile	Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection Agency	Awaiting Entry	Emphasizes that anonymized data no longer qualifies as personal data, placing it outside the law's obligations.
Kazakhstan	Order of the Minister No. 90/NQ (23 February 2024) — On Amendments and Additions to Order No. 385/NQ (On Amendments and Additions to the Ministerial Order of 14.10.2022 No. 385/NQ)	Repealed	Details technical and procedural transformation to prevent identification prior to inclusion in SDU using ETL/CDC tools.

What it triggers

In the Province of Buenos Aires, anonymization is required before inputting sensitive or personal information into third-party generative AI systems.source
Under Order No. 90/NQ, organizations were required to anonymize or pseudonymize data prior to inclusion in SDU, with operators permitted to perform anonymization via ETL/CDC tools if the organization could not, until it was repealed.source

Definitions (5)

Technical processes and techniques that render personal data non-identifiable such that individuals cannot be reasonably re-identified from the data, used as a required safeguard before inputting sensitive or personal information into third-party IAGen systems.

Resolución 4/2025 – Directrices de uso de Inteligencia Artificial Generativa en la Administración Pública (Provincia de Buenos Aires, Subsecretaría de Gobierno Digital)Definition 1 of 5

The process by which personal data are transformed so that the data subject cannot be identified by any means reasonably likely to be used, producing data that no longer qualify as personal data under the statute and are therefore outside the law's personal-data obligations.

Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection AgencyDefinition 2 of 5

A technical and procedural transformation applied to personal data to irreversibly prevent identification of individuals (or sufficiently reduce re-identification risk) prior to inclusion in SDU; the Order requires organizations to anonymize or pseudonymize data and permits the operator to perform anonymization via ETL/CDC tools if the organization cannot.

Order of the Minister No. 90/NQ (23 February 2024) — On Amendments and Additions to Order No. 385/NQ (О внесении изменений и дополнения в приказ Министра от 14.10.2022 №385/НҚ)Definition 3 of 5

The irreversible process of transforming personal information so that it no longer allows the person to be identified, either directly or indirectly, and cannot be re-identified, allowing for retention for serious and legitimate purposes.

An Act to modernize legislative provisions as regards the protection of personal information (Law 25)Definition 4 of 5

The process of modifying personal data so that it can no longer be attributed to a specific subject without the use of additional information.

Қазақстан Республикасының «Дербес деректер және оларды қорғау туралы» ЗаңыDefinition 5 of 5

Not to be confused with

Pseudonymization

Pseudonymization allows re-attribution with additional information, while anonymization definitions here emphasize irreversibility or non-re-identification.

De-identification

De-identification focuses on removing or obscuring identifiers, whereas anonymization often implies broader irreversible transformation processes.

Questions and answers

What must be done before using personal data in generative AI in Buenos Aires?

Resolution 4/2025 requires anonymizing personal data using technical processes so individuals cannot be re-identified before inputting into third-party generative AI systems. This acts as a safeguard for sensitive information.

Does anonymization remove data from privacy law obligations?

Under Chile's Law No. 21.719, anonymized data no longer qualifies as personal data and falls outside the law's obligations. Quebec's Law 25 allows retention of anonymized data for serious and legitimate purposes.

What happens to anonymized data under Kazakhstan's laws?

Kazakhstan's Law defines anonymization as modifying data so it cannot be attributed without additional information. Order No. 90/NQ required anonymization before SDU inclusion until repealed.