What is Anonymization?
Also called De-identification.
Anonymization is the process of transforming data so that individuals can no longer be identified from it, by anyone, using any means reasonably likely to be used. Under the GDPR truly anonymized data falls outside data protection law entirely, which is why the standard is strict and why many datasets described as anonymized do not actually meet it.
The test is not whether obvious identifiers were removed but whether re-identification is reasonably possible. Combinations of quasi identifiers such as postal code, birth date and gender can single out individuals in large populations, and published research has repeatedly re-identified records from datasets that had names stripped. Assessment therefore considers auxiliary data an attacker could plausibly obtain, not just the dataset in isolation.
Common techniques include generalization, where precise values become ranges; suppression, where rare values are dropped; aggregation, where only group level statistics are published; and perturbation, where controlled noise is added. Formal models such as k-anonymity and its refinements attempt to quantify the protection, and differential privacy provides a stronger mathematical guarantee at the cost of accuracy.
Whether robust anonymization is achievable for rich, high dimensional data is genuinely contested. Free text, location traces and behavioral logs contain so many distinguishing signals that meaningful anonymization often destroys the analytical value being sought. Many practitioners consequently treat pseudonymization plus access control as the honest description of what they have achieved.
The practical consequence is a decision about legal posture. Claiming anonymization removes data from the scope of privacy law, which is attractive but places the burden of proof on the claimant. If a regulator or researcher later demonstrates re-identification, the data was personal data throughout, and every processing step is assessed on that basis.
Key points
- Standard is irreversibility by any means reasonably likely
- Removing names is not anonymization by itself
- Quasi identifiers combine to single people out
- Rich text and behavioral data resist meaningful anonymization
- A failed claim means the data was personal data all along
In practice
A team wants to publish usage statistics from an assistant. Exporting transcripts with names removed would not be anonymized, since writing style, project details and account references remain identifying. Instead they publish aggregate counts by week and feature, suppress any bucket with fewer than a threshold number of accounts, and round durations into bands. The result supports the analysis without containing records traceable to an individual.