How do you de-identify or anonymize a dataset so you can keep it past its retention period without breaking privacy rules?

When a record reaches the end of its retention period, the default action is disposition: destruction or transfer. But you may have a legitimate reason to keep the underlying data longer, for example trend analysis, research, or training models. De-identification and anonymization let you preserve analytical value while reducing or removing the personal data that triggers privacy rules.

De-identification vs. anonymization

These terms are related but not identical.

• De-identification removes or masks direct identifiers (names, account numbers, contact details) so a record no longer obviously points to an individual. Re-identification may still be possible if a key or linking dataset exists.
• Anonymization is stronger. Done properly, it irreversibly transforms data so a person cannot reasonably be re-identified by anyone, even by combining it with other sources.

Treat fully anonymized data as no longer “personal.” De-identified data that can still be relinked is usually still subject to privacy obligations.

Common techniques

• Removing or masking direct identifiers.
• Pseudonymization, replacing identifiers with tokens (keep the key separate and protected, or destroy it for stronger results).
• Generalization, reducing precision (a birth year instead of a full date, a region instead of an address).
• Aggregation, reporting group totals rather than individual rows.
• Adding statistical noise to limit what any single record reveals.

Watch for indirect identifiers. A combination of ZIP code, age, and gender can single someone out even with names gone.

Build it into your program

Anonymization is a records and information governance decision, not just a technical one.

• Document why retention beyond the schedule is justified and authorized.
• Apply data minimization, keep only the fields you actually need.
• Assess re-identification risk before release, and reassess as new linkable data appears.
• Record the method used and who approved it, so the process is defensible.

A risk-based approach like the one described in the NIST Privacy Framework helps you match safeguards to the sensitivity and reuse of the data. If the records are covered by a specific regime such as the Privacy Act of 1974, confirm that retention and reuse remain consistent with that authority.

For related guidance, see the privacy and PII topic hub.