Data Anonymization.

Irreversibly transforming personal data so that no individual can be identified, directly or indirectly, even when combined with other available information. It belongs to the Privacy & Data Protection category of cybersecurity.

Irreversibly transforming personal data so that no individual can be identified, directly or indirectly, even when combined with other available information.

Data anonymization removes or alters identifiers, quasi-identifiers, and sensitive attributes so that re-identification is no longer reasonably possible. Techniques include suppression, generalization, perturbation, aggregation, and randomization, often evaluated against privacy models such as k-anonymity, l-diversity, t-closeness, or differential privacy. Truly anonymized data falls outside the scope of GDPR (Recital 26), but the bar is high: regulators such as the EDPB and CNIL require formal re-identification risk assessments considering means "reasonably likely" to be used, including auxiliary datasets. Common pitfalls include relying on hashing alone, releasing high-dimensional micro-data, or treating pseudonymized data as anonymous.

Defences for Data Anonymization typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Anonymization, De-identification (strong sense).