Can a business be identified from de-identified data?

Yes, a business can sometimes be identified from data that's been called "de-identified." Whether that risk is acceptable depends on the privacy rule that governs the data and on how thoroughly the identifiers have been removed. Each major regulation spells out a test: would a reasonable person, using the de-identified set together with publicly available sources, be able to link the record to a specific company?

What the major privacy rules say about de-identification

HIPAA (45 CFR 164.514(b)). A covered entity may share health-related information without patient consent if the 18 identifiers listed in the rule are removed. The rule also requires a statistical expert to confirm that the remaining data cannot be used, alone or with other data, to identify an individual or a business. In practice you strip names, geographic units smaller than a state, dates (except the year), telephone numbers, email addresses, and any other direct link, then verify that no one could reasonably match what's left to a specific business.

California Consumer Privacy Act. Section 1798.140(b). CCPA defines "de-identified personal information" as data that a reasonable person could not link to a consumer or household after direct identifiers are removed. The law does not prescribe a technique; it leaves the assessment to the data holder, who must be able to show that the re-identification risk is low. Remove names, IDs, precise locations and dates, then demonstrate that the remaining fields are too vague for anyone to point to a particular company.

GDPR Recital 26 and Article 4(1). GDPR calls data "anonymous" when it has been processed so the data subject is not identifiable, taking into account all means reasonably likely to be used for identification. Recital 26 says a controller can deem data anonymous if it cannot be linked to an individual without additional information that is not reasonably accessible. For a business, that means removing company name, tax ID, precise address, unique contract numbers, and then assessing whether external sources could bridge the gap.

UK GDPR (same text as EU GDPR). The United Kingdom follows the EU definition of anonymous data. ICO guidance adds that the test includes "reasonably foreseeable" means of re-identification. In other words, consider what a competent researcher could do with public company registers, industry reports, or other open data to single out your firm.

Canada's PIPEDA (Principle 4.8). PIPEDA permits disclosure of de-identified information if it is "practically impossible" to re-identify an individual. The privacy commissioner's guidelines extend this to business records, requiring that any combination of data that could single out a specific organization be removed or rendered unusable.

Australia's Privacy Act 1988. Australian Privacy Principle 6. APP 6 allows use or disclosure of de-identified information without consent, provided the data is not reasonably re-identifiable. The Australian Privacy Commissioner says the test is whether a person could, by using the data together with other lawful means, reasonably identify the entity.

All of these regimes share the "reasonable person" test: can someone, using the de-identified data and any publicly available information, figure out which company the record belongs to?

How to run a quick re-identification risk check for your own records

1. List the fields you plan to share (for example, ticket subject, resolution time, product code).
2. Remove obvious identifiers: company name, tax ID, exact address, phone numbers, email addresses, and any unique internal codes.
3. Ask yourself whether a competitor, regulator or journalist could combine the remaining fields with public sources, industry benchmarks, supplier listings, court filings, to pinpoint your firm.

If the answer is "yes," the data does not meet the de-identification standard of the applicable law and you should apply additional masking steps.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

Our de-identification service, what you can expect

When you ask us for a quote, we follow a process that mirrors the tests described above:

• We map the systems that hold the data and identify which privacy rules apply.
• The raw files are exported to an isolated, logged workspace; the original copies are deleted on a recorded date.
• Direct identifiers are replaced with stable placeholders such as "employee 632" or "project A." The key that links placeholders to real names is destroyed.
• Dates, locations and numeric codes are truncated or shifted enough to break easy linkages.
• A trained reviewer reads the free-text fields to spot anything that might still be traceable.
• An independent staff member who did not do the cleaning attempts to re-identify the data; the result is documented.

The de-identification work is billed as a separate project, and the fee is quoted after we know the systems and the volume. In a licensing deal the AI lab that buys the data usually covers this cost, but the parties can agree otherwise.

You can learn more about the service on our de-identification page.

When you are ready to move forward

If you have confirmed that your operational records can be stripped of the identifiers a reasonable person could use to locate your company, the next step is to ask us for a de-identification quote. Use the button below to start the request; we will ask a few basic questions, run a quick assessment, and return a price estimate without moving any of your data until you approve the terms. You can also see how we handle the licensing step on our sell page.