What is anonymization?
Anonymization processes personal data so that the people it describes can no longer be identified by anyone, using any means reasonably likely to be used, including by the organization that did the processing. Unlike pseudonymization, it leaves no key or lookup table that could reverse it. Under GDPR, data that is truly anonymous is no longer personal data, so the regulation stops applying to it. That is a high bar, and the burden of showing it has been met sits with the organization releasing the data. It is also spelled anonymisation.
Common techniques
- Suppression: remove direct identifiers such as names, account numbers and email addresses, and drop records so rare that they stand out.
- Generalization: replace exact values with ranges, such as an age band instead of a birth date, or a partial ZIP code.
- Aggregation: publish counts and averages instead of individual records.
- Perturbation: add calibrated statistical noise. Differential privacy formalizes this, and the U.S. Census Bureau used it to protect 2020 census results.
A common measure is k-anonymity. Quasi-identifiers are fields that identify people in combination, such as ZIP code, birth date and sex, and k-anonymity requires every record to share its combination of them with at least k minus 1 other records.
Example: generalizing a data set
| Original | After generalization (k = 3) |
|---|---|
| ZIP 60614, age 42, asthma | ZIP 606**, age 40-49, asthma |
| ZIP 60618, age 47, diabetes | ZIP 606**, age 40-49, diabetes |
| ZIP 60622, age 44, asthma | ZIP 606**, age 40-49, asthma |
Each released row now matches at least three people on ZIP and age. Even so, if all three records had shared one diagnosis, anyone known to be in the group would have that diagnosis revealed, which is why stronger models such as l-diversity also require variety in the sensitive field.
The re-identification problem
Removing names is rarely enough. In 2006, AOL published about 20 million search queries from roughly 650,000 users, with each user name replaced by a number. Reporters at The New York Times identified one user from her searches alone, and AOL withdrew the data. Linkage attacks like this combine a supposedly anonymous release with other sources such as voter rolls, social media or public reviews. Every new data set released makes the next linkage easier, so anonymization is a risk judgment that needs periodic review, not a permanent guarantee.
Anonymization in health data
In the United States, HIPAA treats health information as de-identified, and therefore no longer protected health information, when it meets one of two standards. Safe Harbor removes 18 listed types of identifier and requires that the organization have no actual knowledge that the remaining data could identify someone. Expert Determination has a qualified expert apply statistical methods and document that the risk of re-identification is very small.
Anonymization vs. pseudonymization and masking
Pseudonymization keeps a way back, so the data stays personal data for whoever holds the key. Anonymization removes the way back. Static data masking for test environments also produces data that can't be traced to the original, but its goal is realistic fake values for testing, not statistically useful releases. Encryption is the opposite of anonymization: it is designed to be reversed by the key holder.
Anonymization on the CompTIA Security+ exam
Anonymization is taught under SY0-801 objective 3.3, which covers protecting data, as the irreversible level of de-identification. Wording such as "publish the data so no individual can be identified, even by the company", "the process must not be reversible" or "share statistics with researchers without any personal data" points to anonymization. Distractors include pseudonymization, which is reversible with the separately held key; tokenization, which a vault can reverse; encryption; and data masking that only hides values on screen.