Data Anonymisation in Research: Techniques, Standards, and When It’s Required

Anonymising research data means processing it so that no individual can reasonably be identified from it, either directly or by combining it with other information a reasonable adversary might plausibly obtain. It is one of several related but distinct controls researchers use to reduce privacy risk in data that will be stored, shared, or published — alongside pseudonymisation, de-identification, and controlled access under a data use agreement. This guide covers the practice: what genuinely counts as anonymised, the standards that govern when it is required, the actual techniques used to do it, and where anonymisation stops being sufficient on its own.

Anonymisation vs. de-identification vs. pseudonymisation

These three terms get used loosely, but the regulatory frameworks that matter to research data draw real distinctions between them:

• Anonymisation is the strongest standard: the data (or a dataset plus any information reasonably available to a recipient) no longer permits identification of a specific individual, by any means reasonably likely to be used. Under the EU General Data Protection Regulation (GDPR), Recital 26 is explicit that genuinely anonymous information falls outside the Regulation’s scope entirely — it is no longer “personal data” at all, because it does not relate to “an identified or identifiable natural person.” Recital 26 also sets the test for whether that bar has actually been met: identifiability is assessed using “all the means reasonably likely to be used,” accounting for the cost, time, and technology available to make the identification, not a theoretical worst case.
• Pseudonymisation is weaker and stays inside data-protection scope. GDPR Article 4(5) defines it as processing personal data “in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information,” provided that additional information (a key, a crosswalk table, a code list) is kept separately and protected by technical and organisational measures. Because that additional information exists somewhere, GDPR Recital 26 treats pseudonymised data as still personal data, and pseudonymisation is a security control, not an exit from the Regulation.
• De-identification is the broader, more framework-agnostic umbrella term used especially in U.S. contexts — NIST Special Publication 800-188, De-Identifying Government Datasets: Techniques and Governance (final, September 2023), treats de-identification as a spectrum of techniques and residual re-identification risk assessment, without a single fixed legal threshold. In U.S. health research specifically, the HIPAA Privacy Rule operationalises de-identification through two defined methods at 45 CFR §164.514(a)-(b): Safe Harbor (removing 18 specified identifier categories) and Expert Determination (a qualified statistician applying accepted methods to conclude re-identification risk is very small). Data de-identified either way is no longer “protected health information” and falls outside HIPAA’s Privacy Rule.

The practical consequence: whether a given dataset is “anonymised” is not self-certified by the researcher who processed it — it depends on which framework governs the data (GDPR, HIPAA, an institutional policy, a funder mandate) and that framework’s specific test.

When anonymisation is actually required

Anonymisation is not a universal default step in research data management; it is triggered by specific obligations:

• Data-sharing and open-data mandates. Funder and journal data-sharing policies (see CASRAI’s guide to data sharing policy) increasingly require that data made publicly available not disclose participant identities. Where a dataset containing personal or health information is destined for open deposit rather than controlled access, anonymisation (or a defensible de-identification method) is usually the condition that makes open sharing lawful and ethical at all.
• GDPR Article 89(1), for EU/UK research. Article 89(1) names pseudonymisation as an accepted safeguard for processing personal data for scientific or historical research, archiving in the public interest, or statistical purposes — but it explicitly states a preference for full anonymisation over pseudonymisation wherever the research purpose can still be achieved that way. Appropriate safeguards under Article 89(1) are also the precondition for the Member State derogations from certain data-subject rights that research often relies on.
• Human-subjects research scope. Under the U.S. Common Rule (45 CFR §46.102(e)), a study is only “human subjects research” subject to IRB oversight if it involves identifiable private information or biospecimens. Whether removing identifiers from existing data or specimens changes a study’s regulatory status is an IRB determination, not something a researcher can decide unilaterally — but it is one of the reasons anonymisation is deliberately built into secondary-data-use study designs from the outset.
• Institutional and repository policy. Many repositories and institutional data governance policies require anonymisation or a documented de-identification method as a condition of deposit for any dataset that originated from human participants, regardless of whether GDPR or HIPAA technically applies.

Where none of these apply — internal, controlled-access data shared only under a signed data use agreement with defined permitted uses — anonymisation is often neither required nor desirable, because it destroys information a legitimate secondary analysis may need. Controlled access with contractual restrictions is the correct tool when re-identification risk can be managed rather than eliminated.

Core anonymisation and de-identification techniques

NIST SP 800-188 and the HIPAA de-identification standard both describe the same broad family of statistical disclosure control techniques, applied individually or combined depending on data type and reuse purpose:

• Suppression / removal. Deleting direct identifiers outright — names, national ID numbers, exact addresses, contact details. This is the core mechanic of HIPAA’s Safe Harbor method, which lists 18 specific identifier categories (names; geographic subdivisions smaller than a state; all elements of dates except year, subject to further restriction for ages over 89; telephone/fax numbers; email addresses; Social Security numbers; medical record numbers; health plan numbers; account numbers; certificate/license numbers; vehicle identifiers; device identifiers; URLs; IP addresses; biometric identifiers; full-face photos; and any other unique identifying number, characteristic, or code) that must be removed before Safe Harbor de-identification is met.
• Generalisation / aggregation. Replacing a precise value with a broader category — an exact birth date becomes a five-year age band, a street address becomes a region, an exact diagnosis code becomes a broader condition category. Reduces precision without deleting the field entirely.
• Perturbation / noise addition. Adding controlled statistical noise to numeric values so aggregate patterns are preserved but exact individual values are not recoverable.
• Data swapping. Exchanging values for a given field between similar records, preserving overall distributions while breaking the link between any one individual and their original values.
• k-anonymity. A formal disclosure-risk criterion: a dataset satisfies k-anonymity if every combination of quasi-identifying variables (age, sex, postcode, occupation — fields that are not identifiers alone but can be combined to re-identify someone) matches at least k individuals in the dataset, so no record can be isolated to fewer than k people.
• Differential privacy. A mathematically defined technique for adding calibrated noise to query results or released statistics such that the presence or absence of any single individual’s data has a bounded, quantifiable effect on the output — used increasingly in large-scale statistical releases where formal, provable guarantees matter more than ad hoc masking.
• Synthetic data generation. Generating a new dataset that reproduces the statistical properties of the original without any record corresponding to a real individual. CASRAI’s guide to synthetic data in research covers generation, documentation, and disclosure practice for this approach in more depth — it is increasingly used as an alternative to anonymising an existing dataset, rather than a technique applied to one.
• Expert Determination. Rather than applying a fixed rule, a qualified expert statistically assesses re-identification risk against the specific recipient population and concludes the risk is very small — the second of HIPAA’s two defined de-identification pathways, and conceptually closer to NIST SP 800-188’s general risk-based framing than Safe Harbor’s fixed identifier list is.

No single technique is universally correct. Removing identifiers alone (Safe Harbor-style suppression) is straightforward to apply and audit but can leave quasi-identifiers intact; k-anonymity and differential privacy give more defensible, quantifiable risk guarantees but require more statistical expertise to apply correctly and can materially reduce a dataset’s analytic utility. The choice should be documented and driven by the sensitivity of the data and the intended reuse, not applied as a rote checklist step.

Re-identification risk does not go to zero

A dataset that looks anonymised in isolation can still be re-identifiable once combined with other, independently available data — the “mosaic effect.” GDPR Recital 26’s “all means reasonably likely to be used” test exists precisely because identifiability has to be judged against what a realistic adversary could plausibly assemble, not just against the dataset in isolation. Quasi-identifiers (a combination of birth date, sex, and postcode has been shown in published re-identification research to uniquely identify a large share of a population) are the recurring failure mode: individually innocuous fields become identifying in combination. This is why formal, quantifiable measures like k-anonymity and differential privacy exist — they give a way to reason about combination risk rather than relying on a subjective judgement that a field “isn’t identifying.”

Anonymisation should therefore be treated as a documented, risk-assessed decision with a stated method and a stated residual-risk judgement — not a one-time technical step that, once done, is assumed permanently safe regardless of what other data later becomes available.

Anonymisation, controlled access, and Indigenous data governance

Anonymisation is not always the right or sufficient tool, particularly for data about or from Indigenous peoples or other communities where collective, rather than only individual, interests are at stake. The CARE Principles for Indigenous Data Governance, developed by the Global Indigenous Data Alliance, hold that Collective Benefit, Authority to Control, Responsibility, and Ethics apply to data governance decisions alongside — not replaced by — technical anonymisation or the FAIR principles for data reuse more broadly. Removing individual-level identifiers does not on its own resolve questions of who has authority to control access to community-level data. Where this applies, anonymisation should be considered alongside governance frameworks like CARE and Indigenous data sovereignty, not as a substitute for them.

Documenting anonymisation in a data management plan

For a research administrator or data steward, anonymisation decisions belong in the study’s data management plan, not left implicit:

1. Classify the data’s sensitivity and identify which framework applies (GDPR, HIPAA, an institutional policy, a funder’s data-sharing requirement, or a combination).
2. Choose a method proportionate to the reuse purpose. Fixed-rule methods like Safe Harbor are auditable and fast; risk-based methods like Expert Determination, k-anonymity, or differential privacy preserve more analytic utility but need documented expert justification.
3. Document the method and the residual-risk assessment in the DMP and any data-sharing statement, rather than asserting “data has been anonymised” without specifying how.
4. Reassess before each new release or linkage. A dataset anonymised for one release can become re-identifiable if it is later linked to other public data — re-assess risk at each new disclosure point, not only at the point of original collection.
5. Default to controlled access, not weaker anonymisation, when in doubt. If the utility a secondary analysis needs cannot survive genuine anonymisation, a data use agreement governing controlled access to pseudonymised or identifiable data is usually the more defensible choice than applying anonymisation loosely enough to undermine its own guarantee.

Frequently asked questions

Is anonymised data still “personal data” under GDPR?

No — genuinely anonymous data, meeting GDPR Recital 26’s “all means reasonably likely to be used” test, falls outside the Regulation’s scope entirely. Pseudonymised data, by contrast, remains personal data under GDPR because the means to re-link it to an individual (a key or crosswalk) still exists, even if held separately.

What is the difference between anonymisation and pseudonymisation?

Anonymisation is intended to be irreversible: no one, including the original data holder, can reasonably re-identify individuals. Pseudonymisation is reversible in principle by whoever holds the separately-stored key or crosswalk, which is why data-protection law continues to treat pseudonymised data as personal data while treating properly anonymised data as outside its scope.

Can anonymised research data ever be re-identified?

In principle, if combined with enough external data, yes — this is the “mosaic effect” and the reason regulatory tests (like GDPR’s) judge identifiability against realistic combination risk, not the dataset alone. It is also why techniques with formal, quantifiable guarantees (k-anonymity, differential privacy) are increasingly preferred over ad hoc identifier removal for higher-risk datasets.

Does anonymising data remove it from IRB/Common Rule oversight?

Whether a study counts as human subjects research under the U.S. Common Rule turns on whether it involves identifiable private information (45 CFR §46.102(e)). Anonymising existing data can be relevant to that determination, but it is the IRB, not the researcher, who makes the determination for a given study.

What is the HIPAA Safe Harbor method?

One of two HIPAA-defined de-identification methods (45 CFR §164.514(a)-(b)): removing 18 specified categories of identifiers from health data. The other, Expert Determination, uses a qualified statistician’s risk assessment instead of a fixed identifier list. Data de-identified by either method is no longer “protected health information” under the HIPAA Privacy Rule.