Anonymization

Anonymization transforms records containing personal information so that no individual can be re-identified, even by combining the data with other available sources. Unlike pseudonymization, which substitutes identifiers with codes that can be reversed using a separate key, true anonymization is permanent and one-way: once data is anonymized, the original identities cannot be recovered. In recordkeeping this distinction matters enormously, because genuinely anonymized data may fall outside privacy obligations and retention controls that govern personally identifiable information, while pseudonymized data generally does not. Anonymization supports lawful reuse of records for research, statistics, training, and public release while reducing exposure of personally identifiable information. A common example is preparing a dataset of case files for analysis by stripping names, addresses, and dates of birth, and generalizing fields such as exact ages into ranges so that no single record can be traced back to a person. Records managers should document the technique applied, validate that re-identification risk is acceptably low, and distinguish anonymization from redaction, which obscures specific content within an otherwise intact record.