What is De-identification?

How it works

NIST, the U.S. standards agency, calls de-identification “a general term for any process of removing the association between a set of identifying data and the data subject”. Its guidance, SP 800-188, written by experts at NIST and the U.S. Census Bureau, was released in September 2023 and updated in February 2025. The goal is to limit disclosure risk to people and organizations while still allowing meaningful statistical analysis.

It is a family of techniques, not one tool. NIST lists removing identifiers, transforming quasi-identifiers and generating synthetic data. A quasi-identifier is a detail such as a birth date or job title that is harmless alone but can point to one person when combined with others. NIST also warns that tools that merely mask personal information may not be enough. The international standard ISO/IEC 20889 classifies these techniques and applies to organizations of every type and size.

You will see both spellings. NIST uses “de-identification” and “deidentification”, and California’s statute uses “deidentified”.

Where the rules differ

Each law sets its own bar for when data stops counting as personal.

• HIPAA (U.S. health data): de-identified information neither identifies nor gives a reasonable basis to identify a person. HHS recognizes two methods, Expert Determination and Safe Harbor.
• CCPA (California): deidentified information is not “personal information”, but the business must publicly commit to keep it deidentified and not try to reidentify it, except to test its own process.
• GDPR (EU): regulators separate pseudonymisation from anonymisation. Pseudonymised data, where a key or lookup table can reconnect it to a person, is still personal data.

This is general information, not legal advice; ask counsel how it applies to you.

The limits

De-identification reduces risk; it does not erase it. FTC staff say hashing does not make data anonymous, because the same input always yields the same hash. A 2019 study found 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. ISO’s preview notes that de-identification does not always guarantee the desired result, and that its techniques focus on table-like data, so they may not apply to free-form text, images, audio or video.

Why it matters when selling data

Business data such as messages, documents and tickets is largely free-form text. ISO notes its table-focused techniques may not apply to that kind of data, so names and identifiers buried in sentences need careful handling, alongside a rights review of contracts and policies.

SellMyData, for example, explains what it removes and replaces with consistent placeholders, and the limits of that process, on its de-identification page. Buyers see only a redacted sample before purchase, a licensed lab receives the de-identified dataset rather than raw data, and company exports are deleted within 30 days of the de-identified dataset being approved. Placeholders keep a conversation readable; whether a given dataset meets a particular legal test is a question for counsel.

Before licensing any dataset, ask which legal standard the buyer expects and what re-identification risk remains.