Data Anonymization Standards.
1. Introduction
Data anonymization standards are the legal, technical and organizational principles used to transform personal data into information from which an individual cannot reasonably be identified, either directly or indirectly.
Anonymization is important in data protection, artificial intelligence, medical research, financial services, public administration, cybersecurity and competition law. It enables organizations to analyze and share datasets while reducing the risk of exposing individuals' identities.
However, merely deleting names, telephone numbers or email addresses does not necessarily anonymize a dataset. A person's identity may still be inferred by combining information such as age, location, occupation, transaction history or medical records.
Under the European Union's General Data Protection Regulation (GDPR), genuinely anonymous information falls outside the regulation's scope, whereas pseudonymized information can remain personal data.
European Commission+1
Central legal question: What degree of protection is sufficient to ensure that a person is no longer reasonably identifiable from a dataset?
The answer depends on the applicable legislation, the nature of the data, the technologies available, the likelihood of re-identification and the circumstances in which the data will be used.
2. Meaning and scope of data anonymization
Data anonymization is a process through which identifying information and identifying relationships are removed or sufficiently transformed so that an individual can no longer reasonably be identified.
For example, a hospital may want to publish statistics concerning patients treated for a particular disease. Removing patient names is only the first step. The hospital must also consider whether combinations of age, diagnosis, admission date and location could reveal a patient's identity.
Three different data-protection concepts
Identifiable personal data
The dataset contains information that identifies or can reasonably be linked to an individual, such as a name and medical record.
Pseudonymized data
Names are replaced with codes, but additional information or a linkage key can reconnect the records to individuals. Data-protection obligations generally continue to apply.
Anonymized data
Identification is no longer reasonably likely using the means realistically available in the relevant circumstances. Under the GDPR, genuinely anonymous information is outside its scope.
Legal foundation: GDPR Articles 4(1), 4(5) and Recital 26.
European Commission+1
3. Principal legal standards for anonymization
There is no single worldwide anonymization standard that automatically satisfies every privacy law. The appropriate standard must be assessed under the governing legal regime.
A. The identifiability standard
The identifiability standard asks whether an individual can be identified by means reasonably likely to be used, taking into account factors such as cost, time, available technology and technological developments.
This approach is particularly important under GDPR Recital 26.
For example, replacing a patient's name with a random identifier may be insufficient if a researcher can match the patient's age, rare disease and admission date against publicly available information.
B. The reasonable-risk standard
An organization should assess the practical risk that the anonymized dataset could be used to identify an individual.
Relevant factors include:
The sensitivity of the original information.
The uniqueness of individual records.
The availability of external datasets.
The technical capabilities and incentives of likely recipients.
The consequences of successful re-identification.
The feasibility of reversing or bypassing the anonymization process.
The required protection should be proportionate to the risks. Medical, genetic and precise-location datasets may require stronger safeguards than broad, non-sensitive statistical data.
C. The singling-out, linkability and inference tests
A widely used technical and regulatory framework evaluates anonymization through three risks:
Singling out: Can one person's record be isolated from the dataset?
Linkability: Can records from different sources be connected to the same individual?
Inference: Can sensitive information about an individual be deduced even without discovering their name?
These tests are associated with the Article 29 Working Party's Opinion 05/2014 on anonymization techniques and remain useful when evaluating whether a dataset is genuinely anonymous. They are not, by themselves, a universal statutory test.
European Commission+1
4. Major anonymization techniques and their legal significance
Redact sensitive data from images | Sensitive Data Protection | Google Cloud Documentation
1. Data masking and removal of direct identifiers
Names, addresses, telephone numbers and identification numbers are removed or obscured.
Limitation: Removing direct identifiers alone rarely establishes that the data is anonymous.
2. Pseudonymization and tokenization
Direct identifiers are replaced by codes or tokens. The identifying key is kept separately with strict access controls.
Limitation: If the data can be reconnected to a person, it generally remains personal data.
PPT - Anonymized Data: Generation, Models, Usage PowerPoint Presentation - ID:353375
3. Generalization and k-anonymity
Exact ages, dates or locations are converted into broader categories. In a k-anonymous dataset, each record shares its quasi-identifier pattern with at least \(k-1\) other records.
Limitation: K-anonymity alone may not prevent disclosure of sensitive attributes or identification through external data.
What is differential privacy? | ExpressVPN Glossary
4. Differential privacy
Carefully calibrated statistical noise limits how much an analysis reveals about any one person's participation.
Limitation: It is a mathematical privacy guarantee under defined assumptions, not automatic proof that every underlying dataset is anonymous.
Is Synthetic Data GDPR-Compliant? | EM360Tech
5. Synthetic data generation
Artificial records are generated to reproduce useful statistical patterns without simply publishing the original records.
Limitation: Synthetic data may still disclose information if the generation process memorizes or reproduces identifiable training examples.
The appropriate technique depends on the data and the proposed use. Organizations should evaluate the combined effectiveness of the techniques, rather than assume that using any one technique guarantees legal compliance.
5. Important case laws on data anonymization and identifiability
The following judgments establish important principles concerning privacy, identifiable information and pseudonymization. Not all of them directly determine a technical anonymization threshold; their relevance lies in the legal tests they establish.
Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)
Supreme Court of India · (2017) 10 SCC 1 · Nine-judge Constitution Bench
Facts: The Supreme Court considered whether the right to privacy is protected as a fundamental right under the Indian Constitution.
Judgment: The Court unanimously recognized privacy as a fundamental right protected under Article 21 and other freedoms guaranteed by Part III of the Constitution.
NHRC+1
Legal principles relevant to anonymization:
Privacy is connected to dignity, personal liberty and individual autonomy.
State interference with privacy must satisfy the applicable constitutional requirements.
Personal information requires safeguards appropriate to the context in which it is collected and used.
Application: Anonymization can reduce privacy risks when governments or institutions analyze personal datasets. However, anonymization does not automatically make every form of data collection or subsequent use lawful. The purpose, legal authority and proportionality of the original processing may still matter.
Significance: Puttaswamy supplies a foundational constitutional framework for evaluating data-protection practices in India. It does not prescribe a numerical anonymization threshold or a specific technical method.
Case 2: Patrick Breyer v. Bundesrepublik Deutschland (2016)
Court of Justice of the European Union · Case C-582/14 · Judgment of 19 October 2016
Facts: German federal websites stored dynamic IP addresses of visitors. The question was whether an IP address could constitute personal data even though the website operator could not directly identify the visitor using the address alone.
Judgment: The Court held that a dynamic IP address could constitute personal data for the website operator if it had legal means enabling it to identify the visitor using additional information held by the internet service provider.
EUR-Lex+1
Legal principle: Information need not contain a person's name to qualify as personal data. The availability of additional information and realistic identification routes must be considered.
Application to anonymization: A dataset containing IP addresses, timestamps and browsing activity may remain identifiable even after names have been removed. Organizations must assess the possibility of linking records with external datasets.
Significance: This is a leading authority for the proposition that removing direct identifiers does not necessarily anonymize information.
Case 3: European Data Protection Supervisor v. Single Resolution Board (2025)
Court of Justice of the European Union · Case C-413/23 P · ECLI:EU:C:2025:645 · Judgment of 4 September 2025
Facts: Following the resolution of Banco Popular Español, the Single Resolution Board transferred pseudonymized comments from affected shareholders and creditors to Deloitte for valuation work.
Judgment: The Court clarified the assessment of personal data in the context of transferring pseudonymized information. The fact that a recipient may be unable to identify a person does not necessarily mean that the information is anonymous for the organization that holds the additional identifying information.
curia+1
Legal principles:
Pseudonymization and anonymization are distinct.
Identifiability must be assessed in the relevant processing and transfer context.
The recipient's practical ability to identify a person may differ from that of the transferring organization.
The original controller's data-protection obligations are not automatically eliminated by pseudonymizing data before transfer.
Application: A company cannot simply replace customer names with codes and declare the data anonymous. It must evaluate the identifying information it retains, the recipient's capabilities and the risks of linkage.
Significance: This is a particularly important modern judgment for organizations sharing pseudonymized datasets with auditors, researchers, cloud providers and AI developers. The judgment concerns Regulation (EU) 2018/1725, the EU institutions' data-protection regime; its reasoning is relevant to GDPR interpretation but should not be presented as a ruling directly under the GDPR.
Case 4: Breyer and the reasonable-means approach
Although Breyer is already discussed above, its broader importance deserves emphasis: the legal analysis is not limited to whether identification is theoretically possible. It considers whether means of identification are realistically available, including through information held by another entity.
This approach helps distinguish genuine anonymization from a dataset whose identifiers have merely been concealed.
EUR-Lex+1
Case 5: Peter Nowak v. Data Protection Commissioner (2017)
Court of Justice of the European Union · Case C-434/16 · Judgment of 20 December 2017
Facts: The dispute concerned a candidate's examination answers and examiner comments, and whether they constituted personal data under EU data-protection law.
Judgment: The Court held that examination answers and examiner comments could constitute personal data because they related to the candidate.
European Commission
Legal principle: Personal data is not restricted to names, addresses or unique identifiers. Information can relate to a person through its content, purpose or effect.
Application: Anonymization assessments must consider the substantive content of a dataset, not merely whether direct identifiers have been deleted. Free-text responses, medical narratives and employment assessments may reveal identity through contextual details.
Significance: Nowak helps explain why data minimization and identifier removal alone may not be sufficient to establish anonymity.
6. Data anonymization under Indian law
India's principal general statute is the Digital Personal Data Protection Act, 2023 (DPDP Act). Its relationship with anonymization requires particular care.
A. Digital Personal Data Protection Act, 2023
The Act regulates digital personal data and defines personal data by reference to information about an identifiable individual. Anonymization is not established merely by removing a name or substituting a code.
A key distinction is that the Act does not provide a detailed, generally applicable technical anonymization standard comparable to the GDPR's express treatment of anonymous information in Recital 26. This leaves important questions about when a transformed dataset can be treated as outside the personal-data framework.
PMC+1
Relevant compliance considerations include:
Lawful processing: Organizations should identify the legal basis for processing personal data before anonymization.
Purpose limitation: Data should be processed consistently with the purposes and obligations applicable to the processing.
Security safeguards: The anonymization process and any remaining identifiable source data must be protected.
Retention: Organizations should evaluate whether retaining original identifiable records remains necessary and lawful.
Accountability: They should document their anonymization methodology, risk assessment and verification procedures.
Anonymization should not be treated as a way to retroactively justify unlawful collection or disclosure.
B. Constitutional privacy under Puttaswamy
The constitutional right to privacy influences the interpretation and design of privacy-protective practices in India. In appropriate circumstances, state action involving personal information must meet constitutional requirements, including legality and proportionality.
Indian Kanoon+1
For example, if a public authority publishes a supposedly anonymous health dataset, it should consider whether the publication creates a realistic risk of identifying vulnerable individuals.
C. Important qualification
The DPDP Act's applicability, commencement provisions, implementing rules and any relevant sector-specific obligations must be checked for the particular processing activity and date. Other laws may impose additional confidentiality or disclosure requirements, including in healthcare, banking, employment and research.
7. International comparison of anonymization standards
| Legal framework | Main approach | Practical implication |
|---|---|---|
| European Union — GDPR | Recital 26: reasonably likely means of identification | Genuine anonymity can take data outside GDPR; pseudonymized data generally remains protected. |
| United Kingdom — UK GDPR | Identifiability and risk-based assessment | Data must not identify a person directly or indirectly using reasonably available means. |
| India — DPDP Act, 2023 | Personal data defined by identifiability; no detailed general statutory anonymization methodology | Organizations need a careful, documented assessment and must check applicable rules and sectoral laws. |
European Commission+2
These frameworks should not be treated as interchangeable. A technique that reduces identification risk may be adequate for one limited disclosure but inadequate for a different recipient, dataset or jurisdiction.
This response couldn’t load
RELATED Blog
comments