# What is De-identification?

> De-identification is any process that removes the link between data and the people it describes, limiting the risk of identifying anyone while keeping the data useful. The legal bar differs: HIPAA and California's CCPA each set their own test, and EU law treats pseudonymised data as still personal.

Source: https://sellmydata.com/glossary/de-identification/
Published: 2026-10-28

## How it works

NIST, the U.S. standards agency, calls de-identification ["a general term for any process of removing the association between a set of identifying data and the data subject"](https://csrc.nist.gov/pubs/sp/800/188/final). Its guidance, SP 800-188, written by experts at NIST and the U.S. Census Bureau, was [released in September 2023 and updated in February 2025](https://www.nist.gov/node/1824246). The goal is to [limit disclosure risk to people and organizations while still allowing meaningful statistical analysis](https://csrc.nist.gov/pubs/sp/800/188/final).

It is a family of techniques, not one tool. NIST lists [removing identifiers, transforming quasi-identifiers and generating synthetic data](https://csrc.nist.gov/pubs/sp/800/188/final). A quasi-identifier is a detail such as a birth date or job title that is harmless alone but can point to one person when combined with others. NIST also warns that [tools that merely mask personal information may not be enough](https://census.gov/library/publications/2023/adrm/nist-sp-800-188.html). The international standard [ISO/IEC 20889](https://www.iso.org/standard/69373.html) classifies these techniques and applies to organizations of every type and size.

You will see both spellings. NIST uses ["de-identification" and "deidentification"](https://csrc.nist.gov/pubs/sp/800/188/final), and California's statute uses ["deidentified"](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.).

## Where the rules differ

Each law sets its own bar for when data stops counting as personal.

- **HIPAA (U.S. health data):** de-identified information [neither identifies nor gives a reasonable basis to identify a person](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html). HHS recognizes [two methods, Expert Determination and Safe Harbor](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/index.html).
- **CCPA (California):** deidentified information is [not "personal information"](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.), but the business must publicly commit to keep it deidentified and not try to reidentify it, except to test its own process.
- **GDPR (EU):** regulators separate pseudonymisation from anonymisation. Pseudonymised data, where a key or lookup table can reconnect it to a person, [is still personal data](https://www.edpb.europa.eu/news/edpb-adopts-pseudonymisation-guidelines-and-paves-the-way-to-improve-cooperation-with_en).

This is general information, not legal advice; ask counsel how it applies to you.

## The limits

De-identification reduces risk; it does not erase it. FTC staff say [hashing does not make data anonymous](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous), because the same input always yields the same hash. A 2019 study found [99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6650473/). ISO's preview notes that de-identification [does not always guarantee the desired result](https://cdn.standards.iteh.ai/samples/69373/f0200837a1484de9891b77fb7688e24b/ISO-IEC-20889-2018.pdf), and that its techniques focus on table-like data, so they may not apply to free-form text, images, audio or video.

## Why it matters when selling data

Business data such as messages, documents and tickets is largely free-form text. ISO notes its table-focused techniques [may not apply](https://cdn.standards.iteh.ai/samples/69373/f0200837a1484de9891b77fb7688e24b/ISO-IEC-20889-2018.pdf) to that kind of data, so names and identifiers buried in sentences need careful handling, alongside a [rights review](https://sellmydata.com/rights/) of contracts and policies.

SellMyData, for example, explains what it removes and replaces with consistent placeholders, and the limits of that process, on its [de-identification page](https://sellmydata.com/de-identification/). Buyers see only a [redacted sample](https://sellmydata.com/labs/) before purchase, a licensed lab receives the de-identified dataset rather than raw data, and company exports are [deleted within 30 days](https://sellmydata.com/security/) of the de-identified dataset being approved. Placeholders keep a conversation readable; whether a given dataset meets a particular legal test is a question for counsel.

Before licensing any dataset, ask which legal standard the buyer expects and what re-identification risk remains.

## Frequently asked questions

### What is de-identified data?

It is data that has been processed to remove the association between identifying information and the person it is about. Under California's CCPA, deidentified information falls outside the definition of personal information if the business meets the law's conditions. This is general information, not legal advice; ask counsel how it applies to you.

### Is de-identification the same as anonymization?

Not always. EU regulators (the EDPB) say pseudonymised data that can be linked back to a person with extra information, such as a key or lookup table, is still personal data. Separately, FTC staff in the U.S. have said data is only anonymous when it can never be associated back to a person; this is general information, so ask counsel how it applies to you.

### Does hashing de-identify data?

Not by itself. FTC staff have said hashing does not make data anonymous, because the same input always produces the same hash.

### Can de-identified data be re-identified?

Sometimes. A 2019 study in Nature Communications found that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes, and said this challenges the 'release-and-forget' model (publishing de-identified data and assuming it stays safe forever). Standards such as ISO/IEC 20889 describe de-identification as reducing re-identification risk, not guaranteeing it.

## Sources

- [NIST SP 800-188: De-Identifying Government Datasets: Techniques and Governance](https://csrc.nist.gov/pubs/sp/800/188/final)
- [NIST SP 800-188 release information](https://www.nist.gov/node/1824246)
- [NIST SP 800-188](https://census.gov/library/publications/2023/adrm/nist-sp-800-188.html)
- [ISO/IEC 20889:2018 Privacy enhancing data de-identification terminology and classification of techniques](https://www.iso.org/standard/69373.html)
- [ISO/IEC 20889:2018 preview](https://cdn.standards.iteh.ai/samples/69373/f0200837a1484de9891b77fb7688e24b/ISO-IEC-20889-2018.pdf)
- [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html)
- [HIPAA Privacy Rule guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/index.html)
- [California Civil Code §1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.)
- [Guidelines 01/2025 on pseudonymisation (summary)](https://www.edpb.europa.eu/system/files/2025-02/edpb_summary_202501_pseudonymisation_en.pdf)
- [EDPB adopts pseudonymisation guidelines](https://www.edpb.europa.eu/news/edpb-adopts-pseudonymisation-guidelines-and-paves-the-way-to-improve-cooperation-with_en)
- [No, hashing still doesn't make your data anonymous](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous)
- [Estimating the success of re-identifications in incomplete datasets using generative models](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6650473/)