De-identification removes or transforms information that identifies people, such as names, contact details and account numbers, so records can be shared with less privacy risk. For company records, free text such as emails, tickets and notes is usually the hardest part. Use a documented method, test a sample for residual identifiers, and remember that de-identified is not always anonymous under laws such as the GDPR.
- Free-text fields carry most of the risk in operational records.
- Pseudonymised data is generally still personal data under the GDPR.
- Document what was removed and how, and keep the re-identification key away from the buyer.
Why de-identification comes first
Most AI data buyers want operational patterns, not the identities of your customers or staff. Removing identifiers before delivery reduces privacy risk, contractual exposure and the scope of any personal-data obligations. It is also usually a buyer requirement. See is it legal to sell company data for AI training.
What to look for
- Direct identifiers: names, emails, phone numbers, street addresses, government ID numbers, account and order numbers.
- Quasi-identifiers: job titles, small locations, dates and unusual events that together can point to a person.
- Free text: signatures, greetings, pasted documents and notes inside tickets, emails and chats.
- Attachments and metadata: file properties, image text and email headers.
- Third-party information: details about customers’ customers or partners.
Common techniques
No single technique fits every collection. Most projects combine several.
| Technique | What it does | Limits |
|---|---|---|
| Removal | Deletes fields or passages | Can reduce usefulness |
| Masking or redaction | Replaces values with placeholders | Free-text detection is imperfect |
| Pseudonymisation | Replaces identifiers with consistent tokens | Still personal data under the GDPR |
| Generalization | Coarsens dates, locations or values | Trade-off with detail |
| Sampling and review | Human review of a sample | Does not catch everything |
Health and regulated records
Health information covered by HIPAA has its own de-identification standards: Safe Harbor (removing specified identifiers) and Expert Determination. See the HHS guidance in the sources and our healthcare operational data guide.
Document the method
Write down which fields and patterns were treated, which tools and reviews were used, sample test results and who approved release. Buyers often ask for this, and it supports your own records. NIST SP 800-188 and the UK ICO anonymisation guidance describe risk-based approaches in more depth.
Next step
You do not need to de-identify anything before an initial conversation, which can stay at company level. When a specific buyer and scope are known, plan de-identification against that scope. Our proposal review checklist lists the questions to settle first.
Common questions
Is removing names enough?
Usually not. Emails, phone numbers, addresses, account IDs, signatures and details in free text can still identify people. Rare combinations of facts can too.
What is the difference between de-identified and anonymous?
Definitions vary by law. Under the GDPR, pseudonymised data remains personal data; only data that can no longer reasonably identify someone is treated as anonymous.
Who should do the de-identification?
Your company or a processor acting under your instructions usually does it before records leave your control. The agreement should say who is responsible.
Sources and further reading
Origin Data Partners is independent and not affiliated with any buyer named on this page.