De-identification

An assessment begins with the intended use, recipients, and information already available to them. Names and email addresses are direct identifiers, but dates, locations, uncommon events, and combinations of attributes can also reveal identity. Free-text notes, images, and linked tables require attention beyond a single list of sensitive columns.

Techniques trade some information value for reduced disclosure risk. A team might replace exact dates with broader periods, remove an unusually identifying narrative, or provide access in a controlled environment instead of distributing files. NIST’s guidance recommends choosing a sharing model, setting measurable criteria, and testing disclosure risks. The documentation should record the transformations, assumptions, and residual limitations.

A prospective licensing arrangement should distinguish what has been transformed from what the recipient is permitted to do. Access controls, restrictions on linkage, onward-sharing rules, and retention limits may remain necessary after transformation. A description of the process is more useful than an unsupported assurance that data is “fully anonymous.”

Under the EU GDPR, pseudonymized information can still be personal data. Other jurisdictions and sector-specific rules use different tests. A qualified reviewer should determine which standard applies to the actual dataset and recipient context before disclosure.

Fictional example: A repair company removes customer names from job histories but notices that exact appointment times and rare equipment descriptions could identify a customer when combined with public posts. It broadens the dates, excludes unusually distinctive narratives, and tests whether the remaining information still supports the proposed task. The example does not establish that the resulting records meet any particular legal anonymity standard.

Masking visible identifiers is not the same as demonstrating sufficiently low disclosure risk. Keeping stable substitute IDs can preserve useful longitudinal patterns while also making linkage easier. Synthetic data can introduce its own leakage risks and is not automatically anonymous.

Risk can change when additional datasets become available or when the audience expands. Review should therefore cover the release setting as well as the transformed values. De-identification also does not by itself establish ownership, permission to license, or compliance with every confidentiality obligation.