Data anonymization

What is meant by data anonymization, and how is it different from similar terms?#

Data anonymization means the people behind the data can no longer be identified by any means reasonably likely to be used, not just that names were deleted. EU data protection authorities have said that removing directly identifying elements is not enough on its own, and that pseudonymisation is not a method of anonymisation because it only reduces linkability to the original identity.

The terms below are often used as if they were interchangeable. They are not, and the difference decides which rules still apply to the data.

How do you test whether data is really anonymized?#

You test anonymization by asking whether someone could still single out a person, link records about them, or infer facts about them, using the means reasonably likely to be available. Those three questions come from the EU Article 29 Working Party opinion on anonymisation techniques, and GDPR Recital 26, as quoted by the EU Court of Justice, says the means to consider include singling out and that cost, time and available technology all count.

The UK ICO frames the same idea as the motivated intruder test: consider the practical steps someone who wants to identify people from the data is reasonably likely to take. A practical review usually works through the checks below before any dataset leaves the company.

• 1Singling out: look for rows that are unique on a combination of fields, such as job title plus site plus start date.
• 2Linkability: ask whether the fields could be joined to public or purchased data, such as ZIP codes, company names or timestamps.
• 3Inference: check whether a sensitive value can be guessed with high confidence from other fields, even if no row is unique.
• 4Free text: scan notes, emails, transcripts and attachments, where names and account numbers hide outside structured fields.
• 5Keys and copies: confirm that no lookup table, token map or original export travels with the data.
• 6Recipient and use: record who receives the data and what else they hold, because the same file can be anonymous to one party and identifiable to another.

Which anonymization techniques fit which business records?#

The right technique depends on which fields create the risk, and most real datasets need a combination. The Working Party opinion groups the main techniques into randomization and generalization and discusses noise addition, permutation, differential privacy, aggregation, k-anonymity, l-diversity and t-closeness, concluding that they can give privacy guarantees only when engineered appropriately for the context and objectives.

U.S. health rules show how specific generalization can get: HIPAA Safe Harbor allows only the first three digits of a ZIP code when that area holds more than 20,000 people, and folds ages over 89 into a single 90 or older group. The table below is an editorial starting point for common business records, not a compliance standard.

At SourceX, the company approves exactly what is released, once per deal, and sees what would leave before anything is shared. Whether a given dataset meets an anonymization or de-identification standard is a legal judgment that counsel makes on the specific facts.