As the sector seeks to unlock the value of its datasets for analytics and AI training, the tension between anonymisation and pseudonymisation is becoming ever more pressing. True anonymisation remains the gold standard but often strips away the richness that gives data its value. Pseudonymisation preserves that utility but keeps data within the scope of data protection law. The Court of Justice of the European Union's SRB decision brings welcome nuance, confirming that whether pseudonymised data counts as personal depends on the realistic means of re-identification available to the controller, not theoretical possibilities. This more contextual approach could open new space for innovation, provided businesses can show re-identification risks are genuinely low. Those in the sector that invest early in verifiable safeguards and governance frameworks will be best placed to harness data confidently and compliantly in the age of AI.