Anonymization requires more than deleting names. Assess whether people could still be identified from the proposed data, alone or in combination with other information. Pseudonymized information can remain personal data. Technical preparation does not independently resolve ownership, confidentiality, or the legal basis for a new use.
Begin with purpose and minimum necessary scope
Specify the buyer’s task before choosing the fields to release. If a task can be evaluated without exact dates, locations, identities, or raw audio, assess whether those elements can be omitted or generalized. Exclude unsuitable records before spending time on transformation.
Look beyond structured identifier columns
Free text, attachments, signatures, URLs, file paths, photographs, rare incidents, and combinations of role and location can identify people. Sensitive facts may be present even when a record has no name. Review representative samples across time periods and business units rather than checking only a clean recent export.
Distinguish common controls
Redaction removes selected information. Generalization reduces precision. Pseudonymization replaces identifiers while a mapping or other means of identification may remain. Aggregation combines records. Each changes utility and risk differently; none should be called anonymous solely because a tool was applied.
Evaluate risk in context
Consider the recipient, available external information, unique combinations, and foreseeable attempts to identify people. The ICO’s guidance is a primary starting point for the UK distinction between anonymization and pseudonymization. Other legal regimes and specific uses require their own review.
Protect the preparation environment
Limit access to originals, secure temporary copies, and document transformations. Keep any identity mapping separately controlled. Avoid sending raw customer or employee content to an unapproved third-party processing service. Define when temporary artifacts are deleted and how review decisions are recorded.
Test both privacy and usefulness
Check that identifiers do not survive in alternate fields or old versions. Separately verify that the prepared records still preserve the task-relevant sequence and outcome. Report missing fields, transformations, and known biases to the buyer. A privacy control that breaks the intended task may require a narrower use or a decision not to license.
Keep a release record
Retain the approved purpose, scope, process version, quality checks, residual-risk assessment, reviewer decisions, and transfer conditions. Reassess when the recipient, dataset, processing environment, or proposed purpose changes.
For Japanese records, consult the PPC’s current materials and advisers familiar with the applicable requirements. Use the legal checklist alongside these technical questions; neither an automated scan nor our readiness tool is a legal clearance.
Sources & verification
Primary sources checked 2026-10-08. Provider statements describe advertised offerings, not independently audited results.