Skip to content

Question

Can anonymized data be licensed?

By SourceX Editorial · Updated

Short answer

Yes. Data that is genuinely anonymised — so individuals can no longer be identified by reasonably likely means — generally falls outside data-protection law such as GDPR, which makes it far easier to license. The difficulty is achieving that standard. Free text, audio and rich records can often be re-identified, so many datasets are better described as de-identified or pseudonymised, which may still be regulated.

Part of: Trust center

Explanation#

GDPR does not apply to anonymous information, but pseudonymised data (where identifiers are replaced but could be re-linked) is still personal data.

In US healthcare, HIPAA recognises two de-identification methods: Safe Harbor (removing listed identifiers) and Expert Determination.

Examples#

  • Aggregated metrics: usually anonymous
  • Support tickets with names masked: often still pseudonymous because of free-text details
  • Call audio: voices themselves can be identifying

Rights and privacy#

  • Document the de-identification method
  • Assess re-identification risk, especially with free text
  • Prohibit buyers from attempting re-identification by contract

How licensing works#

A business describes its data, buyer demand is assessed, scope and permitted use are proposed, the data is prepared and de-identified, an agreement is signed, and the approved dataset is delivered. See data licensing for detail.

Relevant industries

Relevant data types

Related questions

Sources

  1. Regulation (EU) 2016/679 (GDPR), EUR-Lex
  2. UK ICO: Anonymisation guidance
  3. HHS: Guidance on de-identification of protected health information
  4. NIST Privacy Framework

General information, not legal advice. Editorial policy.

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

See if your company qualifies Talk to SourceX
See if your company qualifies