What a de-identification record must include

A de-identification record lists exactly what you removed, how you removed it, and who verified the result. It is the proof you can show regulators, buyers, or auditors that the data no longer contains personal identifiers.

Core elements of a de-identification record

1. Source description. System name, file type, date range, and a brief note on the business process that generated the data (for example, support tickets from a CRM).
2. Identifier inventory. A table that enumerates every field that contained personal information before cleaning (name, email, employee ID, location, etc.).
3. Method applied. Removal, masking, pseudonymisation, aggregation, or a statistical technique, together with the tool or script version you used.
4. Test performed. The legal test that confirms the data no longer qualifies as personal. Cite the rule (HIPAA Safe Harbor, CCPA de-identified information, GDPR Recital 26, and so on).
5. Result of the test. A short statement such as "all identifiers removed" or "risk of re-identification below the GDPR threshold".
6. Reviewer and date. The person who performed or oversaw the de-identification and the date of completion; include their role (privacy officer, external expert, etc.).
7. Retention and destruction plan. How long the raw files will be kept, the deletion date, and the method of secure disposal.

These seven points give a buyer, regulator, or internal auditor a complete picture of what was done and why it complies.

Legal anchors for each element

HIPAA (45 CFR 164.514). The Safe Harbor provision requires removal of 18 specific identifiers, such as names, all elements of dates except the year, and unique numbers. Your record should show that each of those items was stripped. If you rely on an expert determination, attach the statistician's written opinion, the methodology used, and the date of the determination.

California Consumer Privacy Act (CCPA). The statute treats data as de-identified when it cannot be linked to a particular consumer or household. Your record must note the statistical technique or complete removal of direct identifiers and reference the CCPA section that permits this treatment.

GDPR. Recital 26 and Article 4(1) define anonymity as a state where the individual cannot be identified by any means reasonably likely to be used. Explain the anonymisation technique, include the risk assessment, and state that the approach satisfies Recital 26 because re-identification would require disproportionate effort.

UK ICO guidance (2023). The Information Commissioner's Office considers data anonymised when the risk of re-identification is "practically nil". Record the ICO test you followed and the conclusion that the risk falls below that threshold.

Canada. PIPEDA (Principle 4). PIPEDA requires removal of any element that could identify an individual, directly or indirectly. List the fields removed and note compliance with Principle 4.

Australia. Privacy Act (APP 3.2). The Australian Privacy Principles deem data de-identified when it cannot be used to identify a person, alone or in combination with other data. Document the steps that meet APP 3.2 and the date you confirmed compliance.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

A simple template you can copy

Field	Description	Example
Source system	Where the data came from	Ticketing platform "SupportNow"
Date range	Period covered	01-Jan-2020 to 31-Dec-2022
Identifier inventory	List of personal fields before cleaning	Name, email, employee ID, IP address
Method	Technique used	Pseudonymisation with stable hash, removal of dates
Legal test applied	Rule that validates de-identification	HIPAA Safe Harbor (45 CFR 164.514)
Test result	Outcome of the test	All 18 HIPAA identifiers removed
Reviewer	Person who signed off	Jane Doe, Chief Privacy Officer
Review date	When the work was validated	5 Oct 2026
Retention plan	How long raw files stay and deletion method	Keep raw files 30 days, then shred digitally on 6 Oct 2026

Swap the "Legal test applied" row for the rule that applies in your jurisdiction and you have a ready-to-use record.

How to run your own quick compliance check

1. List every column that could reveal a person's identity.
2. Match each column to the identifier list in the applicable law (the 18 HIPAA items, the CCPA direct identifiers, etc.).
3. Apply a removal or masking method and document it.
4. Run the risk-assessment test required by the law. Safe Harbor, expert determination, or the corresponding ICO/GDPR test.
5. Record the outcome in the template above.

If the test shows any remaining risk, repeat the masking step until the result reads "no reasonable risk". That loop gives you a defensible record to hand to an AI lab.

When you need a professional service

We run the whole workflow for you: map your systems, export to a secure workspace, apply the chosen technique, and produce the compliance record. The fee is quoted after we understand your volume and tools, and it is paid by the AI lab that eventually licenses the data, unless you prefer to pre-clean the data yourself. When an expert determination is required, we also generate the written expert opinion. Learn more on our de-identification page.

When you are ready to move the cleaned data into a licensing agreement, see our guidance on selling the data. You can also verify that the offer includes who removes personal information by checking an offer through our offer-check tool.

The next step is simple: click the button below to ask us for a de-identification quote that matches your company's data and the privacy rules that apply.