De-identification
What is De-identification?
The process of removing or obscuring personal identifiers from data to reduce the risk of identifying individuals. De-identified data may still be re-identifiable under certain conditions, unlike fully anonymised data.
Terms that appear alongside de-identification
Each of these is named in at least one of the same controls as de-identification. The number is how many controls name both.
- pseudonymisation 11 shared controls
- gdpr 10 shared controls
- consent 7 shared controls
- nist 7 shared controls
- hipaa 7 shared controls
- audit 6 shared controls
- confidentiality 6 shared controls
- encryption 6 shared controls
Frameworks that govern de-identification
What the standards actually require on de-identification
Requirements naming de-identification across 6 standards, quoted from the control text.
When a representative seeks a de-identification consent it must explain the CDR data de-identification process, any disclosure (including sale) of de-identified data with recipient classes and reasons, any general research use with a link to the description in...
competition-and-consumer-consumer-data-right-rules-2020::4.20L · Rule 4.20L: representatives give the additional de-identification information →De-identify the dataset upon collection by not collecting personally identifiable information.
NIST800-SI-19(1) · SI-19(1) De-identification | Collection →The organization must delete personal data, or turn it into a form from which the individual cannot be identified or re-identified, once the identified purposes no longer need the original data, having mechanisms to erase data when no further processing is ant...
iso-27701-2019::7.4.5 · PII de-identification and deletion at the end of processing →When the identified purposes stop requiring the original personal data, the organization must erase it or convert it into a form from which the individual cannot be identified, or identified again.
iso-iec-27701-2025::A.1.4.6 · PII de-identification and deletion at the end of processing →Per Iowa Code 715D.5-7 ICDPA imposes heightened obligations for sensitive data + children + de-identification. Unique among US state privacy laws Iowa CDPA requires NOTICE + OPT-OUT for sensitive data processing rather than OPT-IN CONSENT (other states VCDPA/C...
ICDPA-SensitiveData-Notice-OptOut-NotConsent-Children-COPPA-Alignment-De-Identification · Iowa CDPA Sensitive Data + Notice + Opt-Out (NOT Consent unlike VCDPA) + Children Under 13 + COPPA Alignment + De-Identification Standards + Heightened Risk Awareness →Protect CDR data from misuse, interference, loss and unauthorised access, and destroy or de-identify redundant CDR data.
AUCDR-PS-12 · Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data →Questions people ask about de-identification
What is De-identification?
Why is De-identification important for compliance?
Which compliance frameworks address De-identification?
Where can I learn more about De-identification?
See how De-identification applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.