What Is Data Anonymization?

Anonymisation aims to transform data so that individuals can no longer be identified — irreversibly, by anyone, including the organisation that performed it. That is a high bar, and the distinction from pseudonymisation matters legally as well as technically.

Pseudonymised data has identifiers replaced but remains linkable with additional information, and under most privacy regimes it is still personal data with all the obligations that follow. Properly anonymised data generally falls outside those regimes entirely — which is exactly why the claim is made more often than it is true.

Re-identification is easier than intuition suggests

Removing names and identifiers is not sufficient. Combinations of ordinary attributes — postcode, date of birth, sex — are frequently unique enough to single out an individual, and linking a supposedly anonymous dataset against any other available source can restore identity.

Rare values are the recurring problem. An uncommon diagnosis, an unusual job title or an outlying value in a small geographic area identifies a person regardless of whether their name was removed. Datasets released as anonymous have repeatedly been shown otherwise using nothing more than publicly available information.

Techniques, and what each gives up

Generalisation reduces precision — an age becomes a range, a postcode becomes a region. Suppression removes rare values entirely. Aggregation reports only groups above a minimum size. Perturbation adds controlled noise.

Each trades utility for protection, and the trade is unavoidable: data useful enough to answer detailed questions retains enough structure to risk identification. Anyone claiming both full analytical utility and genuine anonymity is describing something that does not exist.

For a mathematically grounded treatment of that trade-off, see differential privacy.

Treat the claim as testable

Because the legal consequences of the anonymous/pseudonymous distinction are substantial, the claim deserves evidence. That means assessing re-identification risk explicitly — measuring how unique records are within the dataset, considering what auxiliary information an adversary could plausibly hold, and documenting the reasoning.

Free-text fields deserve particular attention. Clinical notes, support tickets and comments routinely contain identifying detail that structured de-identification never touches, and automated removal from free text is markedly harder than from fields.

Aggregation thresholds are the practical control

For most organisations publishing or sharing derived data, the usable protection is not a sophisticated technique — it is refusing to report on groups below a minimum size.

Small-cell suppression is the standard approach: any figure derived from fewer than a defined number of individuals is withheld, along with enough neighbouring cells that it cannot be recovered by subtraction. That secondary suppression is the part commonly forgotten, and it is how a suppressed cell gets reconstructed from row and column totals.

It is unglamorous and it prevents the majority of realistic re-identification from published statistics, at a cost that is purely a loss of granularity in the smallest groups.

Record the threshold you chose and why, since an assessor will ask how it was determined.

Where to start

Take any dataset you currently describe as anonymised and check whether free-text fields were processed at all. That is the most common gap and the one most likely to contain names.

See privacy obligations in Canada. GuardsArm runs compliance auditing.