# De-identification standards, what each requires

> 6 de-identification and redaction standards were read for what they require removed or transformed, each answer quoted from the standard's own text, read 8 October 2026.

PII Redaction Tool · https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source/ · computed 2026-10-08

**Standards read:** 6 standards (7 texts read; 11 named).

## The answers, question by question

- **The method it accepts:** several methods, by context 2, reasonable measures so the data cannot be linked to a person 1, not stated 1, removing the listed identifiers 1, pseudonymisation with the key kept separately 1
- **What must go, in its words:** stated 6
- **The re-identification safeguard:** stated 6
- **Where it applies:** not stated 3, the United States 2, California 1

## Every standard

| Standard | The method it accepts | What must go, in its words | The re-identification safeguard | Where it applies |
|---|---|---|---|---|
| CCPA deidentified data (Civil Code 1798.140) | reasonable measures so the data cannot be linked to a person | "Deidentified" means information that cannot reasonably be used to infer information… | Publicly commits to maintain and use the information in deidentified form and not to… | California |
| DPA 2018 s.171 (re-identification offence) | not stated | personal data is "de-identified" if it has been processed in such a manner that it can no… | It is an offence for a person knowingly or recklessly to re-identify information that is… | not stated |
| FERPA de-identified records (34 CFR 99.31) | removing the listed identifiers | after the removal of all personally identifiable information provided that the… | whether through single or multiple releases, and taking into account other reasonably… | not stated |
| GDPR pseudonymisation (Art 4(5), Recital 26) | pseudonymisation with the key kept separately | the personal data can no longer be attributed to a specific data subject without the use… | Personal data which have undergone pseudonymisation, which could be attributed to a… | not stated |
| HIPAA de-identification standard (45 CFR 164.514) | several methods, by context | The following identifiers of the individual or of relatives, employers, or household… | The covered entity does not use or disclose the code or other means of record… | the United States |
| NIST SP 800-188 | several methods, by context | De-identification is a general term for any process of removing the association between a… | with the goal of preventing or limiting disclosure risks to individuals and establishments | the United States |

## The sentence each answer rests on (28)

- CCPA deidentified data (Civil Code 1798.140), [California Civil Code 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, The method it accepts: "Takes reasonable measures to ensure that the information cannot be associated with a consumer or household."
- CCPA deidentified data (Civil Code 1798.140), [California Civil Code 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, What must go, in its words: ""Deidentified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer"
- CCPA deidentified data (Civil Code 1798.140), [California Civil Code 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, The re-identification safeguard: "Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information"
- CCPA deidentified data (Civil Code 1798.140), [California Civil Code 1798.140](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140), read 2026-10-08, Where it applies: "California Law >> >> Code Section"
- DPA 2018 s.171 (re-identification offence), [Data Protection Act 2018 section 171](https://www.legislation.gov.uk/ukpga/2018/12/section/171), read 2026-10-08, The method it accepts: No answer on the text, which ran to 9,119 characters when read on 2026-10-08.
- DPA 2018 s.171 (re-identification offence), [Data Protection Act 2018 section 171](https://www.legislation.gov.uk/ukpga/2018/12/section/171), read 2026-10-08, What must go, in its words: "personal data is "de-identified" if it has been processed in such a manner that it can no longer be attributed, without more, to a specific data subject;"
- DPA 2018 s.171 (re-identification offence), [Data Protection Act 2018 section 171](https://www.legislation.gov.uk/ukpga/2018/12/section/171), read 2026-10-08, The re-identification safeguard: "It is an offence for a person knowingly or recklessly to re-identify information that is de-identified personal data without the consent of the controller responsible for de-identifying the personal data."
- DPA 2018 s.171 (re-identification offence), [Data Protection Act 2018 section 171](https://www.legislation.gov.uk/ukpga/2018/12/section/171), read 2026-10-08, Where it applies: No answer on the text, which ran to 9,119 characters when read on 2026-10-08.
- FERPA de-identified records (34 CFR 99.31), [34 CFR 99.31](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), read 2026-10-08, The method it accepts: "may release the records or information without the consent required by § 99.30 after the removal of all personally identifiable information"
- FERPA de-identified records (34 CFR 99.31), [34 CFR 99.31](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), read 2026-10-08, What must go, in its words: "after the removal of all personally identifiable information provided that the educational agency or institution or other party has made a reasonable determination that a student's identity is not personally identifiable"
- FERPA de-identified records (34 CFR 99.31), [34 CFR 99.31](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), read 2026-10-08, The re-identification safeguard: "whether through single or multiple releases, and taking into account other reasonably available information"
- FERPA de-identified records (34 CFR 99.31), [34 CFR 99.31](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31), read 2026-10-08, Where it applies: No answer on the text, which ran to 15,589 characters when read on 2026-10-08.
- GDPR pseudonymisation (Art 4(5), Recital 26), [GDPR full text, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj), read 2026-10-02, The method it accepts: "provided that such additional information is kept separately and is subject to technical and organisational measures"
- GDPR pseudonymisation (Art 4(5), Recital 26), [GDPR full text, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj), read 2026-10-02, What must go, in its words: "the personal data can no longer be attributed to a specific data subject without the use of additional information"
- GDPR pseudonymisation (Art 4(5), Recital 26), [GDPR full text, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj), read 2026-10-02, The re-identification safeguard: "Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person."
- GDPR pseudonymisation (Art 4(5), Recital 26), [GDPR full text, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj), read 2026-10-02, Where it applies: No answer on the text, which ran to 359,179 characters when read on 2026-10-02.
- HIPAA de-identification standard (45 CFR 164.514), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-08, The method it accepts: "A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable"
- HIPAA de-identification standard (45 CFR 164.514), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-08, What must go, in its words: "The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed: (A) Names;"
- HIPAA de-identification standard (45 CFR 164.514), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-08, The re-identification safeguard: "The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification."
- HIPAA de-identification standard (45 CFR 164.514), [45 CFR 164.514](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514), read 2026-10-08, Where it applies: No answer on the text, which ran to 19,659 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), [HHS guidance on de-identification methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-10-08, The method it accepts: "the two methods that can be used to satisfy the Privacy Rule's de-identification standard: Expert Determination and Safe Harbor"
- HIPAA de-identification standard (45 CFR 164.514), [HHS guidance on de-identification methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-10-08, What must go, in its words: No answer on the text, which ran to 79,528 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), [HHS guidance on de-identification methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-10-08, The re-identification safeguard: No answer on the text, which ran to 79,528 characters when read on 2026-10-08.
- HIPAA de-identification standard (45 CFR 164.514), [HHS guidance on de-identification methods](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), read 2026-10-08, Where it applies: "in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule"
- NIST SP 800-188, [NIST SP 800-188 publication page](https://csrc.nist.gov/pubs/sp/800/188/final), read 2026-10-08, The method it accepts: "differential privacy; direct identifiers; Disclosure Review Board; k-anonymity; privacy; pseudonymization; quasi-identifiers"
- NIST SP 800-188, [NIST SP 800-188 publication page](https://csrc.nist.gov/pubs/sp/800/188/final), read 2026-10-08, What must go, in its words: "De-identification is a general term for any process of removing the association between a set of identifying data and the data subject."
- NIST SP 800-188, [NIST SP 800-188 publication page](https://csrc.nist.gov/pubs/sp/800/188/final), read 2026-10-08, The re-identification safeguard: "with the goal of preventing or limiting disclosure risks to individuals and establishments"
- NIST SP 800-188, [NIST SP 800-188 publication page](https://csrc.nist.gov/pubs/sp/800/188/final), read 2026-10-08, Where it applies: "An official website of the United States government"

## Read and set aside

- [NIST IR 8053, De-Identification of Personal Information](https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf): the read stored no text (an empty PDF read)
- [EDPB Guidelines 01/2025 on pseudonymisation](https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2025/guidelines-012025-pseudonymisation_en): a public consultation feedback list; the guideline text is not on the page
- [ICO, anonymisation guidance (under review after the Data (Use and Access) Act)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/): an index page of the ICO's guidance; the guidance text is on sub-pages, and it says it is under review
- [ISO/IEC 20889:2018, de-identification terminology and techniques](https://www.iso.org/standard/69373.html): the charter admits it for: the standard's title, edition and technique classification only; the text is paywalled and never quoted

## Methodology

Each standard's own official texts and guidance were read through estate-fetch and stored whole (sha256 on every row). For every text, four questions were answered from its own words: the method it accepts, what must go, in its words, the re-identification safeguard, where it applies. Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the text read does not address the question. A standard with several texts reads 'varies' where they disagree. 6 standards, 7 texts.

## Sources

- [45 CFR 164.514 - HIPAA de-identification standard (safe harbor, 18 identifiers)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (read)
- [HHS, guidance on methods for de-identification of PHI](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) (read)
- [California Civil Code 1798.140 (CCPA definitions incl. deidentified)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140) (read)
- [34 CFR 99.31 - FERPA disclosure of de-identified education records](https://www.ecfr.gov/current/title-34/subtitle-A/part-99/subpart-D/section-99.31) (read)
- [NIST SP 800-188, De-Identifying Government Datasets](https://csrc.nist.gov/pubs/sp/800/188/final) (read)
- [NIST IR 8053, De-Identification of Personal Information](https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.8053.pdf) (not-terms)
- [Regulation (EU) 2016/679 (GDPR), incl. Art. 4(5) pseudonymisation and Recital 26](https://eur-lex.europa.eu/eli/reg/2016/679/oj) (read)
- [EDPB Guidelines 01/2025 on pseudonymisation](https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2025/guidelines-012025-pseudonymisation_en) (not-terms)
- [ICO, anonymisation guidance (under review after the Data (Use and Access) Act)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/) (not-terms)
- [Data Protection Act 2018 s.171 - offence of re-identifying de-identified personal data](https://www.legislation.gov.uk/ukpga/2018/12/section/171) (read)
- [ISO/IEC 20889:2018, de-identification terminology and techniques](https://www.iso.org/standard/69373.html) (not-terms)

## Cite or embed

- 6 de-identification and redaction standards were read for what they require removed or transformed, each answer quoted from the standard's own text, read 8 October 2026.
- The method it accepts, by standard: several methods, by context 2 of 6, not stated 1 of 6, pseudonymisation with the key kept separately 1 of 6, reasonable measures so the data cannot be linked to a person 1 of 6, removing the listed identifiers 1 of 6 (6 standards, read 8 October 2026).
- What must go, in its words, by standard: stated 6 of 6 (6 standards, read 8 October 2026).
- The re-identification safeguard, by standard: stated 6 of 6 (6 standards, read 8 October 2026).
- Where it applies, by standard: not stated 3 of 6, the United States 2 of 6, California 1 of 6 (6 standards, read 8 October 2026).

Cite as: "De-identification standards, what each requires", updated 2026-10-08, https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source/.

CSV: https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source.csv
JSON: https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source.json
Embed (plain HTML, static link back): see https://piiredactiontool.com/datasets/piiredactiontool-rules-from-primary-source/#lead