Before a research dataset is shared, deposited, or released beyond the original study team, someone has to answer a specific question: how likely is it that a person in this dataset could be re-identified? “We removed names and addresses” is not an answer to that question — it is a description of one input to it. k-anonymity, l-diversity, and t-closeness are the formal, measurable criteria that turn re-identification risk from a subjective judgment into a number a data custodian, IRB, or funder can actually evaluate.
Quick reference: the three disclosure-risk models
| Model | What it guarantees | What it does NOT guarantee | Typical use |
|---|---|---|---|
| k-anonymity | Every combination of quasi-identifiers (age, sex, ZIP/postcode, admission date, etc.) matches at least k records in the released dataset — no individual can be isolated to fewer than k people. | Says nothing about the sensitive attribute itself. If all k people in a group share the same diagnosis, every member’s sensitive value is exposed even though no single record is identifiable. | Baseline screen for structured/tabular data before release; minimum bar in most institutional de-identification workflows. |
| l-diversity | Within each k-anonymous group (“equivalence class”), the sensitive attribute takes at least l well-represented values — closing the “homogeneity attack” gap left by k-anonymity alone. | Doesn’t account for how far those l values are from the overall distribution. A group that is 99% one diagnosis and 1% spread across others can still technically satisfy l-diversity while leaking a strong probabilistic inference. | Datasets with a single sensitive attribute (e.g., one diagnosis field) where homogeneity within groups is a realistic risk. |
| t-closeness | The distribution of the sensitive attribute within each equivalence class stays within a threshold t of its distribution across the whole dataset — limiting how much an attacker’s belief about any one person can shift just from group membership. | Harder to achieve without heavier generalization/suppression, which reduces analytic utility; doesn’t address linkage across multiple released datasets. | Higher-sensitivity releases (e.g., stigmatizing diagnoses, income) where even a skewed-but-technically-diverse group is an unacceptable risk. |
What “re-identification risk” actually means
Re-identification risk is not about whether a dataset contains obvious direct identifiers — name, medical record number, email — that step is ordinary de-identification and is covered on CASRAI’s data anonymisation guide. Statistical disclosure control (SDC) is the discipline that comes after that step: it asks whether the combination of remaining, non-identifying fields (a quasi-identifier set) could still single someone out, especially when the released data could be linked against an outside source the researcher doesn’t control — a voter file, a hospital discharge database, a social media profile.
The canonical demonstration of this risk is Latanya Sweeney’s k-anonymity work in the early 2000s, which showed that a combination of ZIP code, birth date, and sex uniquely identified a large share of the U.S. population even when no traditional identifier was present in the data — a large-scale test on 1990 U.S. Census data found this combination was unique for roughly 87% of the population, and Sweeney’s related work re-identified specific individuals from “anonymized” state health insurance records by linking them to public voter rolls. This is the finding that k-anonymity was designed to prevent: it forces every quasi-identifier combination to cover at least k people, so no combination is unique.
l-diversity and t-closeness exist because k-anonymity, on its own, only protects against being singled out as an individual record — it does not protect against an attacker inferring your sensitive attribute just from knowing which group you’re in. l-diversity, proposed by Machanavajjhala, Kifer, Gehrke and Venkitasubramaniam, requires diversity of the sensitive value within each group; t-closeness, proposed by Ninghui Li, Tiancheng Li and Suresh Venkatasubramanian, tightens that further by requiring the group’s sensitive-value distribution to resemble the dataset’s overall distribution, closing gaps l-diversity can still leave open (skewness and similarity attacks).
Worked example: applying all three to one dataset
Consider a research dataset of hospital admissions with quasi-identifiers age band, ZIP3, sex and a single sensitive attribute, diagnosis category.
| Step | Action | Result |
|---|---|---|
| 1. Baseline | Raw extract, no generalization | Several quasi-identifier combinations match exactly one person — k=1 for those records, high re-identification risk. |
| 2. Apply k-anonymity (k=5) | Generalize ZIP to 3-digit prefix and age to 5-year bands until every combination covers ≥5 records | No record is uniquely identifiable, but one equivalence class of 5 patients happens to share the same diagnosis — a homogeneity attack: anyone who can place a target in that group now knows their diagnosis with certainty. |
| 3. Apply l-diversity (l=3) | Re-partition or further generalize so each class contains at least 3 well-represented diagnosis values | The homogeneity attack is closed, but one class is 90% “diagnosis A” and 10% split across two rare values — technically 3 distinct values, but a skewed distribution still lets an attacker infer diagnosis A with high confidence. |
| 4. Apply t-closeness (t=0.15) | Require each class’s diagnosis distribution to stay within the threshold of the full dataset’s diagnosis distribution | The skewed class from step 3 fails the check and must be further generalized or suppressed until its distribution is close enough to the overall population — the residual inference risk is now bounded, not just “diverse.” |
This is illustrative of the sequencing logic these three criteria follow — k-anonymity first, then l-diversity to address the homogeneity gap, then t-closeness to address the skewness/similarity gap — not a claim about any specific real dataset.
Choosing k: how the value gets set in practice
There is no universal correct value of k; it is a risk-tolerance decision that has to weigh three things together:
- Sensitivity of the data. A dataset with stigmatizing health, criminal-justice, or immigration-status attributes generally warrants a higher k (and often l-diversity/t-closeness on top of it) than a low-sensitivity operational dataset.
- Availability of linkable outside data. Quasi-identifiers that are also present in a public or semi-public source (voter registration, property records, social media) raise real-world re-identification risk regardless of what k the released dataset itself satisfies — this is a linkage risk, not just an internal-uniqueness risk.
- Utility loss. Every increase in k (or tightening of l/t) requires more generalization or suppression of quasi-identifiers, which degrades the data’s analytic value. Small values (k=3–5) are common for lower-risk research releases; regulatory and public-release contexts more often use k=10 or higher, or move to more conservative disclosure limitation methods (differential privacy, synthetic data) entirely rather than relying on k-anonymity alone.
Because k, l, and t are chosen judgment calls rather than fixed by regulation, a data custodian should document the values used and the reasoning behind them as part of the dataset’s disclosure review record — the same way a Data Use Agreement documents permitted downstream use.
Where this connects to HIPAA’s Expert Determination method
U.S. HIPAA-covered research data has two routes to de-identification under 45 CFR 164.514: Safe Harbor, which removes 18 enumerated identifier categories, and Expert Determination (45 CFR 164.514(b)(1)), under which a person with appropriate statistical and scientific expertise applies generally accepted methods to conclude the risk that the information could be used, alone or in combination with other reasonably available information, to identify an individual is very small — and documents that analysis and its methods. HHS guidance on Expert Determination does not mandate k-anonymity, l-diversity, or t-closeness by name; it leaves the specific statistical method to the expert’s judgment. In practice, these three criteria (and related quantitative disclosure-risk methods) are among the tools an expert applying that standard commonly uses to produce a defensible, documented risk estimate, precisely because “very small risk” is otherwise a subjective phrase that an ad hoc redaction pass cannot demonstrate. A Limited Data Set released under a Data Use Agreement, by contrast, follows a different, narrower HIPAA pathway (45 CFR 164.514(e)) and is not the same thing as a fully de-identified dataset under either Safe Harbor or Expert Determination.
Outside HIPAA, the same quantitative logic applies to statistical disclosure control in general — national statistical agencies, data archives, and repositories reviewing datasets for public release use k-anonymity-family methods, along with differential privacy and synthetic data generation, as part of a broader SDC toolkit before deciding what can be released and in what form.
Frequently asked questions
Is k-anonymity enough on its own?
Not for sensitive attributes. k-anonymity guarantees you can’t isolate a single record, but says nothing about what can be inferred about the group as a whole. If every member of a k-anonymous group shares the same sensitive value, that value is effectively disclosed for all of them. l-diversity and t-closeness exist specifically to close that gap.
How is a quasi-identifier different from a direct identifier?
A direct identifier (name, national ID number, email) identifies someone on its own and is removed during ordinary de-identification — see CASRAI’s guide to data anonymisation techniques. A quasi-identifier (date of birth, ZIP code, sex, occupation) does not identify anyone by itself but can combine with other quasi-identifiers, or with an outside dataset, to do so. k-anonymity, l-diversity, and t-closeness all operate on quasi-identifiers, not direct identifiers.
Does k-anonymity satisfy GDPR’s anonymisation standard?
Not automatically. GDPR anonymisation requires that re-identification be reasonably impossible using means reasonably likely to be used — a higher, more context-dependent bar than “not literally the only record.” A dataset can technically satisfy k-anonymity for a given k and still fail this standard if outside linkage data realistically exists. See CASRAI’s comparison of anonymisation vs. pseudonymisation for how these regulatory standards relate to the underlying technique.
What’s the difference between k-anonymity and differential privacy?
k-anonymity is a property of a released dataset itself (every quasi-identifier combination covers ≥k people). Differential privacy is a property of the mechanism that produces an output (a query result or statistic), guaranteeing that including or excluding any one individual changes the output only within a bounded, quantifiable amount, regardless of what an attacker already knows. Differential privacy gives a formal, composable guarantee that doesn’t degrade the same way k-anonymity can when multiple releases are linked together, but it typically requires adding calibrated statistical noise, which k-anonymity does not.
Who typically sets k, l, and t for a research dataset?
Usually the data custodian or statistician conducting the disclosure review, often in consultation with the IRB, the data governance/repository office, or — for HIPAA-covered data being de-identified via Expert Determination — the qualified expert making that determination. The values chosen, and the reasoning for them, should be documented as part of the dataset’s release record.
Last verified 2026-08-16 against 45 CFR 164.514 (eCFR/Cornell LII) and the original k-anonymity/l-diversity/t-closeness literature (Sweeney; Machanavajjhala et al.; Li, Li & Venkatasubramanian). The specific ~87% U.S. re-identification figure and Expert Determination’s regulatory text are the two claims on this page most worth re-checking if HHS guidance or the underlying dataset changes.
