Anonymisation
What is Anonymisation?
The irreversible process of altering personal data so that the individual can no longer be identified, directly or indirectly. Properly anonymised data falls outside the scope of data protection regulations such as GDPR.
Terms that appear alongside anonymisation
Each of these is named in at least one of the same controls as anonymisation. The number is how many controls name both.
- gdpr 22 shared controls
- consent 21 shared controls
- pseudonymisation 17 shared controls
- data protection 13 shared controls
- data subject 12 shared controls
- transparency 10 shared controls
- audit 10 shared controls
- confidentiality 9 shared controls
Frameworks that govern anonymisation
What the standards actually require on anonymisation
Requirements naming anonymisation across 6 standards, quoted from the control text.
Selecting an anonymisation/pseudonymisation scheme should be driven by the data utility required, the threat model (motivated intruder), the data type (microdata, statistical, streaming) and the legal context (whether the goal is GDPR-out-of-scope anonymisatio...
ENISA-DPE-3.4 · Selecting an anonymisation scheme →Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed.
JM-DPA2020-Standard5-Retention-Sec23-Time-Limit-No-Longer-Than-Necessary-Erasure-Deletion-Anonymisation · Jamaica DPA 2020 Standard 5 - Retention + Section 23 + Time Limit + No Longer Than Necessary + Erasure + Deletion + Anonymisation + Retention Schedule + Legal Hold + Backup Considerations + Storage Limitation →Anonymisation techniques are applied when data is collected, processed and stored, to protect privacy, for example adding protective noise locally before data leaves the device. Status in Table B.1: R F (z) (recommendation, a should provision;
etsi-en-303-645::Provision 6-8 · Anonymisation used in collection, processing and storage →Special categories may be processed without consent for scientific or historical research or statistics where necessary and the controller's interest overrides;
greece-law-46242019-hellenic-data-protection-authority-hdpa-implementation-act::Art.30.1 · Article 30(1) to (3): safeguards, anonymisation and separation for research and statistics →The data subject may request erasure, destruction or anonymisation where (1) the data is no longer necessary for its purposes; (2) consent is withdrawn and there is no other legal ground;
pdpa-thailand::S33 · Section 33 Right to erasure, destruction or anonymisation →The retention period is the one set by law or regulation or, failing that, what the purpose requires; where the end cannot be fixed in advance (archiving in the public interest, research, statistics) retention is lawful with technical and organisational safegu...
portugal-law-no-58-2019-data-protection-implementation-act::21 · Article 21 Retention periods, destruction and anonymisation →Questions people ask about anonymisation
What is Anonymisation?
Why is Anonymisation important for compliance?
Which compliance frameworks address Anonymisation?
Where can I learn more about Anonymisation?
See how Anonymisation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.