What is data de-identification?
Definition
De-identification is any process that removes the link between a set of identifying data and the person it belongs to, so the data no longer points to a specific individual.
- Category
- Privacy
- Also called
- data de-identification, deidentification
- Last updated
NIST defines de-identification as a general term for any process of removing the association between a set of identifying data and the data subject (the person the data is about). The key word is "any": it covers several methods, from deleting names to more involved techniques.
A simple example: a hospital shares visit records with researchers after removing patient names, phone numbers and street addresses. The researchers can study trends without seeing who each record belongs to.
De-identification reduces risk but doesn't remove it. If the data that remains is detailed enough, such as a rare job in a small town with a date of birth, it can sometimes be matched to a person using other information. The more outside data that exists about you, the easier that matching gets.
De-identification vs. anonymization
The terms overlap. De-identification describes the act of removing the link. Anonymization usually means the result can't be traced back to anyone. Treat "de-identified" as a claim to check, not a guarantee.
Why it matters to you
Companies often say they only share "de-identified" or "anonymous" data. That can be true and still carry risk, because it depends on how it was done and what other data a recipient holds.
How to protect yourself
- 1
Read what a company says it shares
Look in the privacy policy for words like de-identified, aggregated or anonymized, and for whether the company says it will try to re-link the data.
- 2
Use opt-outs where they exist
Many apps and services let you switch off data sharing or analytics in settings.
- 3
Limit how much identifying detail about you is public
Matching de-identified data back to you usually relies on public details such as your address and phone number. Serus finds where those are listed and removes them from sites that can take them down.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is de-identified data still personal data?
It depends on how well the de-identification was done and the law that applies. If the data can still be tied to a person, it may still count as personal data. Ask a lawyer about a specific case.
Can de-identified data be re-identified?
Sometimes. If enough detail remains, it can be matched with other information to point to a person.
What is the difference between de-identification and anonymization?
De-identification is the process of removing the link to a person. Anonymization usually describes data that can't be traced back at all.
Sources
Something wrong or out of date? Tell us and we'll re-check it.