tl;dr: under GDPR terms, anything is "personally identifiable" if you have the means to resolve it. Technically, writing "John Smith" on a piece of paper can b

tl;dr: under GDPR terms, anything is "personally identifiable" if you have the means to resolve it. Technically, writing "John Smith" on a piece of paper can become anonymous data if there's no way to determine who wrote it and it doesn't mean anything to anyone who has access to the piece of paper (because there's a lot of people with that name or because they don't know anyone by that name) but of course names should be treated as personally identifiable to be on the safe side. On the other end of the spectrum a vague description like "that chubby guy with the crew cut" can be personally identifiable information if you know who it refers to, even if someone else might see it and have no idea who you mean. So the exact lines are highly contextual and pseudonymisation does not guarantee anonymisation: if you call a Rose by any other name, you still know it's her you're talking about.