De-identified data is data from which the details that identify people have been removed or changed. The term has different meanings in health law, in California law and in everyday use. This guide explains the meaning, the common methods, an example, and what the word does not promise.
You will meet the word "de-identified" in a privacy policy, a vendor's contract, a research agreement and the terms of an AI service. It sounds exact. It is not, because several laws use it and each gives it a different meaning, and vendors use it more loosely still.
This guide explains what the term means in the places where it has a legal definition, lists the common methods of de-identification, shows a small example, and says what the word does not promise.
Key terms
- De-identified data
- data from which the details that identify people have been removed, replaced or made less exact. What counts depends on the law or contract that uses the term.
- Direct identifier
- a value that points to one person on its own, such as a name, an email address or a social security number.
- Indirect identifier
- a value that points to a person only in combination with others, such as a postal code, a birth date and a job title.
- Stand-in
- a made-up label used in place of a real value, such as
PERSON_001. - Expert determination
- a method in the US health privacy rule in which a qualified person analyzes a dataset and documents why the risk of identifying anyone is very small.
What does de-identified data mean?
In everyday use, de-identified data is a table that no longer shows who the people in it are. In law, the meaning is narrower and differs by source. Two US definitions show how.
Under the federal health privacy rule (HIPAA), health information is de-identified when it does not identify an individual and there is no reasonable basis to believe it can be used to identify one. The rule then gives two ways to reach that standard: expert determination, or the removal of eighteen listed identifiers while having no actual knowledge that what remains could identify someone. See the HIPAA identifiers, column by column.
Under California's privacy law, "deidentified" information is information that cannot reasonably be used to infer information about, or be linked to, a particular consumer. The business that holds it must also meet three conditions. It must take reasonable measures to ensure that the information cannot be associated with a consumer or household. It must publicly commit to keep the information in deidentified form and not to attempt to link it back to anyone, except to test its own methods. And it must contractually bind any recipient to the same conditions.
The second definition shows something that the first does not. In California, whether data counts as de-identified depends partly on what the business has promised and has required of recipients, and not only on what is in the table.
Under the European data protection law, the word "de-identified" is not defined. The regulation speaks instead of pseudonymization, where the link to the person is kept separately. It also speaks of information from which people can no longer be identified by any means reasonably likely to be used. See the guide to masking, hashing, pseudonyms and encryption.
What are the common methods of de-identification?
Methods usually combine several steps, chosen column by column.
| Method | What it does | Example |
|---|---|---|
| Removal | Deletes the column or the value | Delete the "Name" column |
| Redaction | Replaces the value with fixed text | [ADDRESS] |
| Partial masking | Hides part of the value and keeps the rest | +44 ** **** **23 |
| Stand-ins (pseudonyms) | Replaces each real value with a made-up label, the same one every time | "Anna Hale" becomes PERSON_001 |
| Generalization | Replaces an exact value with a coarser one | Birth date 1987-03-14 becomes 1987; postal code 90210 becomes 902 |
| Rounding and banding | Replaces an exact number with a rounded or grouped one | 48,250 becomes 50,000, or "40,000 to 59,999" |
| Date shifting | Moves dates by a fixed number of days, so the gaps between them stay the same | 2026-04-02 becomes 2026-05-02 |
| Suppression | Removes rare rows or values that stand out | Leave out the only patient over 90 |
| Aggregation | Shares totals or averages, not rows | Average score per class |
Stand-ins and date shifting keep a file useful for analysis, because the same person keeps the same label and the intervals stay correct. They also leave a link that the holder of the key can follow, which is why some laws still treat the result as personal data.
What does a de-identified table look like?
An invented example, before and after.
| Name | Birth date | Postal code | Visit date | Amount | |
|---|---|---|---|---|---|
| Before | Anna Hale | 1987-03-14 | 90210 | 2026-04-02 | 48,250 |
| After | PERSON_001 |
1987 | 902 | 2026-05-02 | 50,000 |
Nothing in the second row names Anna. Whether the second row is de-identified in the sense of a law depends on the other rows: if no one else shares that birth year, postal code area and amount, a person who knows Anna may still find her. See why removing names is not enough.
What does the word not promise?
- It does not mean that no one can be identified. Both definitions above are written in terms of reasonableness and risk, not certainty.
- It does not mean the same in every law. A dataset that meets one definition may not meet another, and a contract may define the word in its own way.
- It does not follow from the method alone. The same steps can be enough for one dataset and one recipient and not for another, because it depends on what else the recipient holds.
- It is not a synonym for the law's term for data that no longer identifies anyone. Vendors sometimes use it for any file with the names removed.
What should you ask before you call a file de-identified?
How can DataAttendant help?
DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file, and it looks for personal details by the values in a column and by its heading. It proposes a treatment for each, such as removal, redaction, partial masking, stand-ins, rounding, grouping or moving dates, and shows a preview and a list of what remains before you download the protected copy. You decide every treatment. It does not decide whether a file counts as de-identified under any law, and it does not make that claim about its output. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps.
Sources
- 45 CFR § 164.514(a) and (b) (the standard for de-identification of health information and its two methods), read on law.cornell.edu on 28 October 2026.
- California Civil Code § 1798.140, definition of "deidentified" (subdivision (m)). Read on the California Legislative Information site on 28 October 2026.
- Regulation (EU) 2016/679, Article 4(5) (pseudonymisation), read on gdpr-info.eu on 28 October 2026.
- The example table is invented.
Where next?
- What is PII? What counts as personally identifiable information in a spreadsheet
- HIPAA de-identification: the Safe Harbor method and the 18 identifiers, column by column
- Masking, pseudonymizing, anonymizing and encrypting: what each one means and what it cannot do
- Why removing names is not enough: how ordinary details can point to one person
- All articles
- What DataAttendant does
- Terms of service