Masking, anonymisation and pseudonymisation

Why this matters

Most analysis does not need to know who a person is. It needs to know that customer 1,042 placed three orders, not that customer 1,042 is a named individual at a particular address. Techniques that hide or remove identity let analysts work with data about people while exposing much less about them, and they are central to privacy law's principle of data minimisation.

They are also easy to overestimate. Removing names does not make data anonymous, and a data set that looks harmless can often be linked back to individuals. The exam asks you to compare these strategies. This lesson covers masking, anonymisation, pseudonymisation and tokenisation, aggregation with minimum group sizes, and re-identification.

The lesson

Masking for display against masking for storage

Data masking hides part or all of a sensitive value, replacing it with characters or substitute values.

Dynamic masking (masking for display) leaves the stored data unchanged and masks it when shown to users who are not entitled to see it. A support agent sees a card number as **** **** **** 4242 while a payments administrator sees it in full. The mask is applied by the database or application according to the viewer's role, much like column-level security.

Static masking (masking for storage) permanently replaces sensitive values in a copy of the data, typically to create realistic data for testing, development or training without exposing real customers. Names are replaced with fictitious names, emails with fake ones, and so on, often keeping formats and relationships consistent so the copy still behaves like real data.

Common masking methods include redaction (replacing with a fixed character), partial masking (showing only part, such as the last four digits), substitution (replacing with realistic fake values), and shuffling (moving real values between records so no value stays with its owner). Masking is effective for its purpose, and a masked copy may still contain enough other detail to identify people.

Anonymisation and why it is harder than removing names

Anonymisation transforms data so that individuals can no longer be identified, by anyone, by any reasonably likely means, and so that the process cannot be reversed. Genuinely anonymised data is generally no longer personal data under laws such as GDPR, which is why the standard is high.

Removing direct identifiers, such as names, email addresses and ID numbers, is only the first step. The remaining fields, called quasi-identifiers, can identify people in combination: postcode, date of birth, sex, job title, a rare condition. Anonymisation techniques address them:

• Generalisation: replacing precise values with ranges, such as an age band instead of a date of birth, or a district instead of a full postcode.
• Suppression: removing values or records that are too distinctive.
• Perturbation: adding small random noise to values while preserving overall patterns.

A common measure is k-anonymity: every combination of quasi-identifiers must be shared by at least k records, so no individual stands out from a group smaller than k.

The cost of anonymisation is utility: the more data is generalised and suppressed, the less detail remains for analysis. Choosing the balance is a judgement, and for sensitive data it should involve the privacy team.

Pseudonymisation and tokenisation, and who keeps the key

Pseudonymisation replaces direct identifiers with a pseudonym, such as a random code, while keeping a separate means of linking the pseudonym back to the person. Analysts can then work with records that are consistent, where the same customer always has the same code, so orders can be joined and counted, without seeing who the customer is.

The crucial point is that pseudonymised data is still personal data, because the link back to individuals exists. Its protection depends entirely on keeping the key or mapping table separate and tightly controlled, available only to those who genuinely need to re-identify, and never stored alongside the pseudonymised data.

Tokenisation is a closely related technique, widely used for payment card numbers: the sensitive value is replaced with a token that has no meaningful relationship to it, and the real value is stored in a secure token vault. Systems that only need to reference the card use the token, which reduces how many systems hold real card data.

Hashing an identifier, a one-way transformation, is sometimes used as a pseudonym, and it has a weakness: if the possible values are guessable, such as email addresses or phone numbers, an attacker can hash candidates and match them. Adding a secret value, a salt or key, before hashing reduces this risk.

Aggregation and minimum group sizes

Aggregation reports summaries rather than individual records: counts, totals and averages for groups. It is often the simplest way to share useful information without sharing personal data.

Aggregation can still disclose information when groups are small. A table showing average salary by department and gender reveals an individual's salary if one department has only one woman. Counts of a rare condition in a small area can point to specific people.

The standard defence is a minimum group size (or cell suppression threshold): any group smaller than a set number, often somewhere between 5 and 10 depending on the policy, is suppressed or merged with others. Care is needed with totals, because a suppressed cell can sometimes be recalculated by subtracting the other cells from a published total, so a second cell may need suppressing too.

Re-identification from combined data sets

Re-identification is the process of linking supposedly anonymous data back to individuals, usually by combining it with other information.

Well-known cases show how little it can take. Research on United States data found that the combination of ZIP code, date of birth and sex was enough to identify a large majority of the population uniquely. Published data sets with names removed have been re-identified by matching them against public records containing those same attributes.

The risk grows as more data is available to combine with, which means a data set that is safely anonymous today may not be tomorrow, and a data set shared with one recipient must be judged against everything that recipient might hold.

Practical defences follow from everything in this lesson: minimise what is shared, generalise quasi-identifiers, apply minimum group sizes, keep pseudonymisation keys separate, control who receives de-identified data under agreements that forbid re-identification, and treat any data about people as potentially identifiable unless it has been carefully shown not to be.