Two related but distinct techniques
Pseudonymization replaces a direct identifier with a substitute value, where a separately held mapping can reverse the substitution back to the original identifier — meaningfully different from genuine anonymization, which is meant to be irreversible by design. Pseudonymized data remains, in principle, tied back to a real individual for anyone holding the corresponding mapping, which means that mapping itself deserves exactly the same access-control rigor as any other sensitive credential; pseudonymization provides essentially no real protection if the mapping is left about as exposed as the original identifier would have been.
Re-identification recovers a specific individual's identity from data that was supposed to be anonymous, often not by breaking any single technical protection directly, but by combining the anonymized data with other, seemingly unrelated external information that together narrows down to one specific person. A dataset can pass every anonymization check applied to it in isolation and still be re-identifiable once cross-referenced against something else.
Why this argues against treating anonymization as permanent
Because re-identification often depends on external data that didn't exist, or wasn't yet publicly available, at the time data was originally anonymized, anonymization can't be treated as a permanent, one-time property established at the moment it's applied — new external datasets that make re-identification newly possible can appear well after the original anonymization was considered fully adequate. This means access to anonymized data still warrants some ongoing scrutiny over time, rather than being treated as permanently and completely safe simply because it once satisfied an anonymization standard.