The three layers
| Layer | Examples | Action |
|---|---|---|
| Direct identifiers | Names, emails, phone numbers, addresses, account and card numbers | Remove or replace with consistent placeholders |
| Quasi-identifiers | Exact dates, small towns, rare job titles, ages | Generalize (month instead of date, region instead of town) |
| Sensitive categories | Health, HR, payroll, union, legal, children's data | Exclude entirely |
Keep links, lose names
Buyers value data where records connect: a ticket, the SOP behind it and the outcome. Replace "Jane Smith" with a consistent token like "Customer_0412" everywhere, so the workflow stays intact. Note the trade-off: unions in the Spirit case argued that keeping links intact ("referential integrity") raises re-identification risk (Stretto).
Synthetic rewrites
Some buyers rewrite records synthetically, keeping the workflow structure while changing the details. Some enterprise programs say they apply this to some datasets.
Standards to aim for
- CCPA: reasonable measures + public no-re-identification commitment + contracts binding recipients. Details.
- HIPAA: Safe Harbor or Expert Determination. Details.
Common pitfalls
- Signatures and footers in emails
- Names inside file attachments and screenshots
- Free-text fields in CRMs ("spoke with Jane about her divorce")
- Usernames and handles that map to real people
- Metadata like author fields and timestamps
Frequently asked questions
How do you anonymize data before selling it to AI?
Remove direct identifiers, generalize quasi-identifiers like dates and locations, exclude sensitive categories, use consistent placeholder tokens to keep records linked, and have the result checked.
Is anonymized data risk-free?
No. HHS notes residual re-identification risk is not zero, and linked records can raise risk. Combine de-identification with contract bans on re-identification.