Re-identification Risk
What is Re-identification Risk?
The possibility that anonymized or pseudonymized data could be linked back to specific individuals through additional data or techniques.
Terms that appear alongside re-identification risk
Each of these is named in at least one of the same controls as re-identification risk. The number is how many controls name both.
- anonymisation 3 shared controls
- gdpr 2 shared controls
- risk assessment 2 shared controls
Frameworks that govern re-identification risk
What the standards actually require on re-identification risk
Requirements naming re-identification risk across 6 standards, quoted from the control text.
The privacy framework runs as business as usual with metrics showing how its controls meet its objectives: clear collection and intent-of-use notices throughout the lifecycle with consent aligned to regulation and withdrawable;
edm-council-cdmc-cloud-data-management-capability-framework::4.2.2 · 4.2.2 The Data Privacy framework is operational →The starting point for appropriate safeguards is a risk analysis or, where required, a DPIA that considers risks to fundamental rights and freedoms beyond private life and data protection;
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::8.2 · 8.2 Start with a risk analysis or DPIA that looks beyond privacy to other fundamental rights, health findings, re-identification, publication and vulnerable or related persons →Synthetic data generation produces artificial datasets that preserve statistical properties of the original data without containing real personal data, supporting model training and testing while reducing personal-data exposure;
ENISA-DPE-4.5 · Synthetic data →An impermissible use or disclosure of PHI is presumed a breach unless the covered entity or business associate demonstrates, through a documented risk assessment, a low probability that the PHI has been compromised, considering at least the four factors in 164...
hipaa-breach-notification-rule::164.402risk · Low probability of compromise risk assessment →Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed.
JM-DPA2020-Standard5-Retention-Sec23-Time-Limit-No-Longer-Than-Necessary-Erasure-Deletion-Anonymisation · Jamaica DPA 2020 Standard 5 - Retention + Section 23 + Time Limit + No Longer Than Necessary + Erasure + Deletion + Anonymisation + Retention Schedule + Legal Hold + Backup Considerations + Storage Limitation →Articles 88 to 90: non-personal data derived from personal health data may be treated as highly sensitive under the Data Governance Act where re-identification risk exists;
regulation-on-the-european-health-data-space-ehds::89 · Resist unlawful third-country access to non-personal health data and transfer personal data only under GDPR Chapter V →Questions people ask about re-identification risk
What is Re-identification Risk?
Why is Re-identification Risk important for compliance?
Which compliance frameworks address Re-identification Risk?
Where can I learn more about Re-identification Risk?
See how Re-identification Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.