Anonymisation

What it means

Anonymisation means altering personal data so that a specific person can no longer be identified, not even by combining it with other data reasonably available to the company or anyone else. Deleting the name is not enough: a person is often given away by a combination of date of birth, postcode and job title.

The difference from pseudonymisation is fundamental. Pseudonymised data can be linked back to a person with a key, so it remains personal data covered by the GDPR. Anonymised data is not personal data at all, and the company can work with it freely.

Typical techniques are aggregation into groups, such as a department’s average pay instead of individual salaries, generalisation, such as an age band instead of a date of birth, suppression of rare values and adding noise. The smaller the group, the harder true anonymity is to achieve.

How it works in practice

Companies use anonymisation for payroll statistics for management, employee satisfaction surveys, analysis of customer data or when handing a database to developers for testing. Real national ID numbers and client addresses have no place in a test environment.

It is also a way to deal with data once the retention period has expired. Instead of full deletion, required by the right to erasure or the principle of data minimisation, the company can keep anonymised summaries for statistics and comparisons over time.

For larger projects we recommend documenting the process: which data was anonymised, with which technique and why the company considers the risk of re-identification negligible. For high-risk processing this may form part of a data protection impact assessment.

What to watch out for

The most common mistake is treating data as anonymised when it is only pseudonymised, such as a table with names replaced by employee numbers. If a list linking numbers to names exists anywhere, the GDPR still applies, and a leak of such a table is a personal data breach.

Beware of small groups too. The average pay of a two-person department reveals each salary to anyone who knows one of them, and survey results from a team of three can often be attributed to a specific person. With small numbers it is better to merge results or not publish them.