De-identification standards, what each requires
6 de-identification and redaction standards were read for what they require removed or transformed, each answer quoted from the standard's own text, read 8 October 2026.
The method it accepts
What must go, in its words
The re-identification safeguard
Where it applies
All the answers, standard by standard
Read across a row for one standard's answers, and open any of them for the quoted sentence, its text and the read date. A "not stated" cell means the text does not speak to that question.
| Standard | The method it accepts | What must go, in its words | The re-identification safeguard | Where it applies |
|---|---|---|---|---|
| CCPA deidentified data (Civil Code 1798.140) | reasonable measures so the data cannot be linked to a person | "Deidentified" means information that cannot reasonably be used to infer information… | Publicly commits to maintain and use the information in deidentified form and not to… | California |
| DPA 2018 s.171 (re-identification offence) | not statedNot addressed in Data Protection Act 2018 section 171 | personal data is "de-identified" if it has been processed in such a manner that it can no… | It is an offence for a person knowingly or recklessly to re-identify information that is… | not statedNot addressed in Data Protection Act 2018 section 171 |
| FERPA de-identified records (34 CFR 99.31) | removing the listed identifiers | after the removal of all personally identifiable information provided that the… | whether through single or multiple releases, and taking into account other reasonably… | not statedNot addressed in 34 CFR 99.31 |
| GDPR pseudonymisation (Art 4(5), Recital 26) | pseudonymisation with the key kept separately | the personal data can no longer be attributed to a specific data subject without the use… | Personal data which have undergone pseudonymisation, which could be attributed to a… | not statedNot addressed in GDPR full text, EUR-Lex |
| HIPAA de-identification standard (45 CFR 164.514) | several methods, by context | The following identifiers of the individual or of relatives, employers, or household… Not addressed in HHS guidance on de-identification methods | The covered entity does not use or disclose the code or other means of record… Not addressed in HHS guidance on de-identification methods | the United StatesNot addressed in 45 CFR 164.514 |
| NIST SP 800-188 | several methods, by context | De-identification is a general term for any process of removing the association between a… | with the goal of preventing or limiting disclosure risks to individuals and establishments | the United States |
Where each answer was read (28)
- CCPA deidentified data (Civil Code 1798.140), California Civil Code 1798.140, read 2026-10-08, The method it accepts:
Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
- CCPA deidentified data (Civil Code 1798.140), California Civil Code 1798.140, read 2026-10-08, What must go, in its words:
"Deidentified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer
- CCPA deidentified data (Civil Code 1798.140), California Civil Code 1798.140, read 2026-10-08, The re-identification safeguard:
Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information
- CCPA deidentified data (Civil Code 1798.140), California Civil Code 1798.140, read 2026-10-08, Where it applies:
California Law >> >> Code Section
- DPA 2018 s.171 (re-identification offence), Data Protection Act 2018 section 171, read 2026-10-08, The method it accepts: No answer on the text, which ran to 9,119 characters when read on 2026-10-08.
- DPA 2018 s.171 (re-identification offence), Data Protection Act 2018 section 171, read 2026-10-08, What must go, in its words:
personal data is "de-identified" if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;
- DPA 2018 s.171 (re-identification offence), Data Protection Act 2018 section 171, read 2026-10-08, The re-identification safeguard:
It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data.
- DPA 2018 s.171 (re-identification offence), Data Protection Act 2018 section 171, read 2026-10-08, Where it applies: No answer on the text, which ran to 9,119 characters when read on 2026-10-08.
- FERPA de-identified records (34 CFR 99.31), 34 CFR 99.31, read 2026-10-08, The method it accepts:
may release the records or information without the consent required by § 99.30 after the removal of all personally identifiable information
- FERPA de-identified records (34 CFR 99.31), 34 CFR 99.31, read 2026-10-08, What must go, in its words:
after the removal of all personally identifiable information provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable
- FERPA de-identified records (34 CFR 99.31), 34 CFR 99.31, read 2026-10-08, The re-identification safeguard:
whether through single or multiple releases, and taking into account other reasonably available information
- FERPA de-identified records (34 CFR 99.31), 34 CFR 99.31, read 2026-10-08, Where it applies: No answer on the text, which ran to 15,589 characters when read on 2026-10-08.
- GDPR pseudonymisation (Art 4(5), Recital 26), GDPR full text, EUR-Lex, read 2026-10-02, The method it accepts:
provided that such additional information is kept separately and is subject to technical and organisational measures
- GDPR pseudonymisation (Art 4(5), Recital 26), GDPR full text, EUR-Lex, read 2026-10-02, What must go, in its words:
the personal data can no longer be attributed to a specific data subject without the use of additional information
- GDPR pseudonymisation (Art 4(5), Recital 26), GDPR full text, EUR-Lex, read 2026-10-02, The re-identification safeguard:
Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
- GDPR pseudonymisation (Art 4(5), Recital 26), GDPR full text, EUR-Lex, read 2026-10-02, Where it applies: No answer on the text, which ran to 359,179 characters when read on 2026-10-02.
- HIPAA de-identification standard (45 CFR 164.514), 45 CFR 164.514, read 2026-10-08, The method it accepts:
A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable
- HIPAA de-identification standard (45 CFR 164.514), 45 CFR 164.514, read 2026-10-08, What must go, in its words:
The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names;
- HIPAA de-identification standard (45 CFR 164.514), 45 CFR 164.514, read 2026-10-08, The re-identification safeguard:
The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.
- HIPAA de-identification standard (45 CFR 164.514), 45 CFR 164.514, read 2026-10-08, Where it applies: No answer on the text, which ran to 19,659 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), HHS guidance on de-identification methods, read 2026-10-08, The method it accepts:
the two methods that can be used to satisfy the Privacy Rule's de-identification standard: Expert Determination and Safe Harbor
- HIPAA de-identification standard (45 CFR 164.514), HHS guidance on de-identification methods, read 2026-10-08, What must go, in its words: No answer on the text, which ran to 79,528 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), HHS guidance on de-identification methods, read 2026-10-08, The re-identification safeguard: No answer on the text, which ran to 79,528 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), HHS guidance on de-identification methods, read 2026-10-08, Where it applies:
in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule
- NIST SP 800-188, NIST SP 800-188 publication page, read 2026-10-08, The method it accepts:
differential privacy; direct identifiers; Disclosure Review Board; k-anonymity; privacy; pseudonymization; quasi-identifiers
- NIST SP 800-188, NIST SP 800-188 publication page, read 2026-10-08, What must go, in its words:
De-identification is a general term for any process of removing the association between a set of identifying data and the data subject.
- NIST SP 800-188, NIST SP 800-188 publication page, read 2026-10-08, The re-identification safeguard:
with the goal of preventing or limiting disclosure risks to individuals and establishments
- NIST SP 800-188, NIST SP 800-188 publication page, read 2026-10-08, Where it applies:
An official website of the United States government
Read and excluded
We read 4 named documents that turned out not to be what this board asks about; why is given for each below. They count toward the reading, not the answers.
- NIST IR 8053, De-Identification of Personal Information: the read stored no text (an empty PDF read)
- EDPB Guidelines 01/2025 on pseudonymisation: a public consultation feedback list; the guideline text is not on the page
- ICO, anonymisation guidance (under review after the Data (Use and Access) Act): an index page of the ICO's guidance; the guidance text is on sub-pages, and it says it is under review
- ISO/IEC 20889:2018, de-identification terminology and techniques: the charter admits it for: the standard's title, edition and technique classification only; the text is paywalled and never quoted
How we read and count
Each standard's own official texts and guidance were read through estate-fetch and stored whole (sha256 on every row).
For every text, four questions were answered from its own words: the method it accepts, what must go, in its words, the re-identification safeguard, where it applies.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question.
A standard with several texts reads 'varies' where they disagree.
6 standards, 7 texts.
All 11 sources
- 45 CFR 164.514 - HIPAA de-identification standard (safe harbor, 18 identifiers) (quoted for reporting from the publisher's official texts and guidance)
- HHS, guidance on methods for de-identification of PHI (quoted for reporting from the publisher's official texts and guidance)
- California Civil Code 1798.140 (CCPA definitions incl. deidentified) (quoted for reporting from the publisher's official texts and guidance)
- 34 CFR 99.31 - FERPA disclosure of de-identified education records (quoted for reporting from the publisher's official texts and guidance)
- NIST SP 800-188, De-Identifying Government Datasets (quoted for reporting from the publisher's official texts and guidance)
- NIST IR 8053, De-Identification of Personal Information (read, set aside)
- Regulation (EU) 2016/679 (GDPR), incl. Art. 4(5) pseudonymisation and Recital 26 (quoted for reporting from the publisher's official texts and guidance)
- EDPB Guidelines 01/2025 on pseudonymisation (read, set aside)
- ICO, anonymisation guidance (under review after the Data (Use and Access) Act) (read, set aside)
- Data Protection Act 2018 s.171 - offence of re-identifying de-identified personal data (quoted for reporting from the publisher's official texts and guidance)
- ISO/IEC 20889:2018, de-identification terminology and techniques (read, set aside)
Take this figure with you
6 de-identification and redaction standards were read for what they require removed or transformed, each answer quoted from the standard's own text, read 8 October 2026.
The method it accepts, by standard: several methods, by context 2 of 6, not stated 1 of 6, pseudonymisation with the key kept separately 1 of 6, reasonable measures so the data cannot be linked to a person 1 of 6, removing the listed identifiers 1 of 6 (6 standards, read 8 October 2026).
What must go, in its words, by standard: stated 6 of 6 (6 standards, read 8 October 2026).
The re-identification safeguard, by standard: stated 6 of 6 (6 standards, read 8 October 2026).
Where it applies, by standard: not stated 3 of 6, the United States 2 of 6, California 1 of 6 (6 standards, read 8 October 2026).
Citation: "De-identification standards, what each requires", updated 2026-10-08, https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source/.
Save the CSV (28 answers; derived 2026-10-08)