Anonymisation and PETs

Consider a hospital releasing a dataset of admissions with names, addresses and record numbers stripped out, leaving date of birth, postcode district, sex and diagnosis. Nothing in that file identifies anyone on its face. But somebody holding a second dataset that carries date of birth, postcode district, sex and a name, of which there are many, can join the two and put a name against a diagnosis. The attack does not break anything. It just reads two files together.

The fields that make this work are the quasi-identifiers: values that identify nobody alone and identify almost everybody in combination. Date of birth, partial postcode and sex are the classic trio, but occupation, employer, household composition, first date of service and any rare category behave the same way. This is why masking the obvious direct identifiers gives so little protection: it addresses the fields that were never the route in.

So identifiability is not a property of a file. It is a property of a file and the world around it together, and it moves as the world changes. A dataset that nobody could re-identify in 2019 may be re-identifiable in 2026 because somebody else published the missing piece in the meantime. The law recognises this directly rather than treating anonymity as a technical state.

The Information Commissioner's Office finalised its guidance on anonymisation and pseudonymisation on 28 March 2025, and it treats identifiability as a spectrum rather than a switch. Data sits somewhere between fully identified and genuinely anonymous, and where it sits depends on the controls around it as much as on the fields it contains.

The practical tool the ICO offers for locating a dataset on that spectrum is the motivated intruder test. You imagine someone who wants to identify a person in the data, who is reasonably competent, who can use the internet, libraries and public documents, and who will take all reasonable steps, but who starts with no prior knowledge of the individuals, no privileged access and no specialist skills. Then you actually try it. Give a colleague the release and an afternoon, and see how far they get. The exercise is cheap and it is a great deal more pleasant to run yourself than to have a journalist run it for you after publication.

The conclusion that follows is uncomfortable but freeing. Anonymisation is a risk assessment, not an operation you perform on a file. Two organisations can apply exactly the same transformations to exactly the same data and reach different answers, because one is publishing to the open web and the other is releasing into a controlled environment under a contract. The transformation is only part of the argument.

Pseudonymisation replaces identifying details with a key or a token, and keeps the mapping back to the original somewhere separate. Analysts see subject 4471 rather than a name, and only a small controlled process can turn 4471 back into a person. The law defines it exactly.

That is not an argument against doing it. Pseudonymisation is named in the law as an example of an appropriate technical measure for securing personal data, and it earns that place. It reduces the number of staff who ever see identities, it limits what a stolen extract discloses, and it makes separation of duties enforceable rather than aspirational. What it does not do is take the dataset out of scope. Subject access requests, retention limits, the lawful basis and the breach obligations all continue to apply.

Tokenisation is the same shape of control applied to a specific sensitive value, most familiarly a card number, with the mapping held in a separately protected vault. Its purpose is to reduce how many systems in an estate ever hold the real value, which shrinks the audit surface. It is a scoping control rather than a privacy guarantee.

One live policy point belongs here, flagged as a proposal rather than as law. The European Commission published its Digital Omnibus package on 19 November 2025, which among other changes would adjust how the personal data definition applies to pseudonymised data. A Commission proposal is not law until the Parliament and the Council have agreed a text, so check where this one has got to before relying on it. The position stated above is the one in force.

k-anonymity is a testable property of a released table. Group the records by their quasi-identifiers. Each group is an equivalence class: everyone in it looks identical on those fields. The table is k-anonymous if no class has fewer than k records, so that no individual can be singled out from the quasi-identifiers alone. NIST SP 800-188 sets this out as a framework for quantifying how hard singling out is.

Reaching a chosen k uses two operations. Generalisation makes values coarser: a date of birth becomes a year of birth, then a five-year band; a full postcode becomes a district, then a region. Suppression removes the records or the fields that cannot be made to fit, which is usually the rare and interesting ones. Both cost analytical value, and the cost is not evenly spread. The rows most likely to be generalised away are the outliers, which are frequently the rows a researcher most wanted.

Three limits matter more than the technique itself. The first is attribute disclosure. If an equivalence class of ten people all share the same diagnosis, nobody has been singled out and everybody in that class has still had their diagnosis revealed. Knowing that someone is in the group is enough. Refinements such as l-diversity exist to address this, and they add their own costs.

The second is composition. NIST records that k-anonymity and related techniques are not compositional: they do not quantify cumulative privacy loss across multiple releases. Two tables that are each perfectly k-anonymous can, read together, isolate individuals neither could isolate alone. That makes k a property of one release rather than of a publication programme, and most organisations publish repeatedly.

The third is time. k is measured against the auxiliary data available now. Auxiliary data only accumulates, so a release that satisfied a chosen k on the day it was published can quietly stop satisfying it, without anyone touching the file. Published tables age badly, and there is no alert for it.

Differential privacychanges the question. Instead of asking whether a released table can be re-identified, it asks whether the output would look meaningfully different had any one person been absent from the input. Statistical noise is added to results, calibrated so that no single individual's presence can be detected from what is published. Because the guarantee attaches to a person rather than to a table, it holds whatever auxiliary data an attacker brings.

The cost is stated openly, which is unusual in this field. The strength of the guarantee is expressed through a parameter, epsilon, where a larger value affords less privacy. The total that an organisation is willing to spend across everything it releases about a dataset is its privacy budget. Each query is calibrated to consume a share of it, and once it is exhausted no further results can be released without weakening the guarantee. Deciding where to set that budget is a policy question about how much accuracy the published statistics may lose, and it should not be settled quietly by whoever is writing the code.

The reference deployment is the 2020 United States Census. Having used data swapping for the 2010 count, the Census Bureau moved to a disclosure avoidance system built on differential privacy, implemented as the TopDown Algorithm, which takes noisy measurements of key queries and reconstructs a microdata file from them. The first product released under it was the redistricting data required by Public Law 94-171, published on 12 August 2021, and the same algorithm was carried into later products including the Demographic and Housing Characteristics file in 2023.

Two features of that deployment teach more than the mathematics. The first is invariants: certain statistics were excluded from the privacy-loss accounting as a matter of policy and published exactly rather than noisily, because the counting rules that govern how seats are apportioned leave no room for noise. Formal privacy in a real system is always framed by decisions of that kind. The second is that the trade was contested in public. Demographers and users of small-area statistics argued that the accuracy cost at low levels of geography was too high, the Bureau published its reasoning and its parameters, and the argument was had in the open. That is what a defensible privacy decision looks like, and it is the opposite of an unexamined promise that a file is anonymous.

Differential privacy has since moved well beyond census work. OpenDP and its collaborators announced a Differential Privacy Deployments Registry, a public repository of real deployments, at the Eyes-Off Data Summit and the 2025 OpenDP Community Meeting, and the US National Institute of Standards and Technology has proposed hosting it. A list of deployments that anyone can read is a useful corrective to the impression that the technique is confined to research papers.

A privacy-enhancing technology is any technique that lets useful analysis happen while limiting what anyone can learn about the individuals in the data. The family is broad, and the useful habit is to ask what each member actually changes.

Federated learningchanges what has to move. Several organisations train a shared model while each keeps its own records, exchanging model updates instead of raw data. NIST, writing with the UK government's Responsible Technology Adoption Unit, is careful about what that buys: the updates themselves can carry information about the training data, so a complete privacy-preserving system pairs the federated arrangement with an approach to output privacy limiting what can be learned about individuals after training. Federation is a data movement decision, not privacy on its own.

Secure multiparty computation changes who has to be trusted. Several parties jointly compute an agreed function over their combined inputs without any of them seeing the others' inputs. Homomorphic encryption goes further, allowing computation directly on encrypted values. Both are real and both are used in production for narrow, high-value problems. At survey level the thing to hold on to is the shape of their cost: they preserve accuracy well and they are expensive in engineering effort and in compute, which is the reverse of the trade differential privacy makes.

Trusted research environments change where the analysis happens. Rather than releasing data, the environment brings the analyst to the data under controls across five dimensions described by the Five Safes framework: safe projects, safe people, safe data, safe settings and safe outputs. It explains why a secure environment can work with data far too disclosive to publish, and why relaxing one dimension has to be paid for in another.

Data clean rooms are the commercial cousin of that idea, common in advertising and in transaction diligence. Two parties bring data together for an agreed analysis, and the environment enforces what may be joined, what may be queried and what may leave. The privacy claim rests entirely on the guardrails the operator enforces, so the questions worth asking are about output controls, minimum aggregation thresholds and audit logging rather than about the label. IAB Tech Lab records version 1.0 of its Data Clean Rooms Guidance and Recommended Practices as released in July 2024, and that document is a reasonable starting point for evaluating an offer.

Two closing cautions. Synthetic data is often described as privacy-safe by construction; it is not. Generated records can still leak facts about the individuals in the source set, so a synthetic release needs its own identifiability assessment rather than an assumption. And a trained model is not automatically safer than the data it was trained on: membership inferenceattacks can determine from a model's outputs alone whether a particular record was in its training set, so releasing a model requires an assessment of its own.

The selection board figure above makes the governing point. These techniques are not ranked. Each buys a different strength of guarantee at a different cost to the analysis, so the choice follows the threat model and the sharing scenario: who is the attacker, what would they have to bring, and what does the analysis need to survive.