Anonymisation
What is Anonymisation?
The irreversible process of altering personal data so that the individual can no longer be identified, directly or indirectly. Properly anonymised data falls outside the scope of data protection regulations such as GDPR.
Terms that appear alongside anonymisation
Each of these is named in at least one of the same controls as anonymisation. The number is how many controls name both.
- gdpr 22 shared controls
- consent 21 shared controls
- pseudonymisation 17 shared controls
- data protection 13 shared controls
- data subject 12 shared controls
- transparency 10 shared controls
- audit 10 shared controls
- confidentiality 9 shared controls
Frameworks that govern anonymisation
What the standards actually require on anonymisation
Requirements naming anonymisation across 6 standards, quoted from the control text.
Selecting an anonymisation/pseudonymisation scheme should be driven by the data utility required, the threat model (motivated intruder), the data type (microdata, statistical, streaming) and the legal context (whether the goal is GDPR-out-of-scope anonymisatio...
ENISA-DPE-3.4 · Selecting an anonymisation scheme →Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed.
JM-DPA2020-Standard5-Retention-Sec23-Time-Limit-No-Longer-Than-Necessary-Erasure-Deletion-Anonymisation · Jamaica DPA 2020 Standard 5 - Retention + Section 23 + Time Limit + No Longer Than Necessary + Erasure + Deletion + Anonymisation + Retention Schedule + Legal Hold + Backup Considerations + Storage Limitation →Anonymisation must render data permanently and irreversibly non-identifiable, considering means reasonably likely to be used. KVKK Board Anonymisation Guidelines (2018) cover techniques (generalisation, masking, perturbation, k-anonymity) and re-identification...
KVKK-Anonymisation · Anonymisation Standards →Define when research data is anonymised (irreversibly non-identifiable) and therefore outside GDPR, with a robust re-identification-risk assessment.
RDCOC-ANO-01 · Anonymisation Criteria →Apply controls that allow contributors to share without unintended attribution, including pseudonymisation, group sharing, and trusted intermediaries.
TIS-12 · Anonymisation and Attribution Controls →Depersonalisation means actions resulting in the impossibility of attributing personal data to a specific data subject without additional information. Depersonalised data may be processed without the constraints applicable to personal data.
UZB-DPL-20 · Anonymisation and Depersonalisation →Questions people ask about anonymisation
What is Anonymisation?
Why is Anonymisation important for compliance?
Which compliance frameworks address Anonymisation?
Where can I learn more about Anonymisation?
See how Anonymisation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.