# How to de-identify company data before licensing it

> A practical overview of de-identifying company records before licensing: removing direct identifiers, handling free text, re-identification risk and documenting the method.

Canonical: https://origindatapartners.com/guides/de-identify-company-data-before-licensing
By: Origin Data Partners
Status: Published
Published: 2026-10-21
Updated: 2026-10-21
Sources checked: 2026-10-15

## Quick answer

De-identification removes or transforms information that identifies people, such as names, contact details and account numbers, so records can be shared with less privacy risk. For company records, free text such as emails, tickets and notes is usually the hardest part. Use a documented method, test a sample for residual identifiers, and remember that de-identified is not always anonymous under laws such as the GDPR.

## Key points

- Free-text fields carry most of the risk in operational records.
- Pseudonymised data is generally still personal data under the GDPR.
- Document what was removed and how, and keep the re-identification key away from the buyer.

## Why de-identification comes first

Most AI data buyers want operational patterns, not the identities of your customers or staff. Removing identifiers before delivery reduces privacy risk, contractual exposure and the scope of any personal-data obligations. It is also usually a buyer requirement. See [is it legal to sell company data for AI training](https://origindatapartners.com/guides/sell-company-data-ai-training-legal).


## What to look for

- Direct identifiers: names, emails, phone numbers, street addresses, government ID numbers, account and order numbers.
- Quasi-identifiers: job titles, small locations, dates and unusual events that together can point to a person.
- Free text: signatures, greetings, pasted documents and notes inside tickets, emails and chats.
- Attachments and metadata: file properties, image text and email headers.
- Third-party information: details about customers’ customers or partners.


## Common techniques

No single technique fits every collection. Most projects combine several.

| Technique | What it does | Limits |
| --- | --- | --- |
| Removal | Deletes fields or passages | Can reduce usefulness |
| Masking or redaction | Replaces values with placeholders | Free-text detection is imperfect |
| Pseudonymisation | Replaces identifiers with consistent tokens | Still personal data under the GDPR |
| Generalization | Coarsens dates, locations or values | Trade-off with detail |
| Sampling and review | Human review of a sample | Does not catch everything |


## Health and regulated records

Health information covered by HIPAA has its own de-identification standards: Safe Harbor (removing specified identifiers) and Expert Determination. See the HHS guidance in the sources and our [healthcare operational data guide](https://origindatapartners.com/guides/license-healthcare-operational-data).


## Document the method

Write down which fields and patterns were treated, which tools and reviews were used, sample test results and who approved release. Buyers often ask for this, and it supports your own records. NIST SP 800-188 and the UK ICO anonymisation guidance describe risk-based approaches in more depth.


## Next step

You do not need to de-identify anything before an initial conversation, which can stay at company level. When a specific buyer and scope are known, plan de-identification against that scope. Our [proposal review checklist](https://origindatapartners.com/guides/data-licensing-due-diligence) lists the questions to settle first.


## Questions and answers

### Is removing names enough?

Usually not. Emails, phone numbers, addresses, account IDs, signatures and details in free text can still identify people. Rare combinations of facts can too.

### What is the difference between de-identified and anonymous?

Definitions vary by law. Under the GDPR, pseudonymised data remains personal data; only data that can no longer reasonably identify someone is treated as anonymous.

### Who should do the de-identification?

Your company or a processor acting under your instructions usually does it before records leave your control. The agreement should say who is responsible.

## Sources

- [NIST SP 800-188: De-Identifying Government Datasets](https://csrc.nist.gov/pubs/sp/800/188/final)
- [UK ICO: Anonymisation guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/)
- [Regulation (EU) 2016/679 (GDPR), EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [HHS: Guidance on de-identification of protected health information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html)

## Related reading

- [Is it legal to sell company data for AI training?](https://origindatapartners.com/guides/sell-company-data-ai-training-legal)
- [GDPR, CCPA and licensing company data for AI](https://origindatapartners.com/guides/data-licensing-gdpr-ccpa)
- [Company data licensing due diligence checklist](https://origindatapartners.com/guides/data-licensing-due-diligence)