Key takeaway
Judge the resulting package and its environment. A field-removal rule alone does not establish anonymity.
Distinguish the terms.
Pseudonymization replaces or separates identifiers while a person may remain identifiable. Effective anonymization aims to make people no longer identifiable in the relevant context. “De-identified” is a broader label whose meaning must be explained. The applicable legal test depends on jurisdiction; ask what standard the receiving program actually proposes.
Inspect what is easy to miss.
The obvious name and email columns are only part of the problem. Free-text notes, attachments, precise times, unusual jobs and linked public information can expose people. A rare combination may identify a customer even when each field looks harmless by itself.
| Material | Starting question |
|---|---|
| Structured identifiers | What must be removed, separated or transformed? |
| Free text | Can narratives reveal names, incidents or account information? |
| Dates and geography | Would generalization preserve enough utility? |
| Images and attachments | Are faces, metadata or third-party documents present? |
| Linked records | Could combinations single out a person? |
Review utility and disclosure together.
Define the buyer question before choosing transformations. A generic fault category may be sufficient where an exact address is unnecessary. Test whether the relationships between problem, action and outcome remain interpretable after exclusions. Do not retain a risky field merely because it might be useful someday.
Make the process reproducible.
NIST SP 800-188 discusses techniques and governance, including limitations of traditional approaches. For a business package, request documented rules, responsible reviewers, exception handling and a versioned assessment. Technical tools support review; they do not replace decisions about purpose and acceptable risk.
- Document source categories and the allowed package.
- Review transformed records, including narrative edge cases.
- Control access to any mapping keys or original material.
- Record the testing approach and residual limitations.
- Reassess when scope, recipients or available linkage information changes.
Do not overpromise control.
Anonymization does not automatically resolve copyright, customer confidentiality or trade secrets. Deletion of the source package also does not imply deletion of trained-model effects. ICO’s UK introduction is marked under review after the Data (Use and Access) Act; check current guidance with the relevant adviser. VOID’s initial referral service does not perform or certify anonymization.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.