Why removing names is not enough: how ordinary details can point to one person

A file with no names can still identify people through a combination of birth date, postal code, job title or other plain columns. This guide shows how to count how many people share each combination, and how to make the values coarser so that no one stands out.

Deleting the name column feels like the main step in protecting a file. It is only the first. The columns that remain can still point to one person, because people are rarely the only ones with a given name but are often the only ones with a given combination of facts.

This guide shows how that happens with an invented example, how to count the people who share each combination in Excel, and how to make values coarser until no one stands out. How to remove personal details from a spreadsheet explains the research behind the idea; this guide is about the practical check.

Key terms

Indirect identifier: a value that does not name anyone but helps to pick one person out when combined with others, such as a postal code, a birth date or a job title.
Combination: the set of values one row has in the indirect-identifier columns, such as "born 1987-03-14, postal code 90210, nurse".
Group size: the number of rows that share one combination. A group size of 1 means that row is unique.
Coarser value: a less exact value that more people share, such as a birth year in place of a birth date, or the first three digits of a postal code in place of all five.
k-anonymity: a property a table has when every combination appears in at least k rows. It was described by the computer scientist Latanya Sweeney in 2002.

How can a file without names point to one person?

Here is an invented table from a small company's staff survey. The names have been removed.

Row	Birth date	Postal code	Job title	Salary band
1	1987-03-14	90210	Nurse	C
2	1987-03-14	90210	Accountant	D
3	1991-07-02	90211	Nurse	C
4	1979-11-30	90210	Nurse	B
5	1987-03-14	90212	Nurse	C

Each row has a combination that no other row shares. Anyone who knows a colleague's birth date and postal code, perhaps from a birthday card and an address book, can find that colleague's row and read the salary band. Nothing in the table says "Anna", and the row is still hers.

The people who would try this are not strangers. They are coworkers, neighbors, former partners or anyone with a reason to look, and they often hold part of the combination already.

Pick the columns that could be used to find a person, which are the indirect identifiers. Do not include the columns that hold what you want to analyze. In the table above they are birth date, postal code and job title.

In Excel, add a column that counts the rows with the same values. If birth date is in column B, postal code in C and job title in D, and the data starts in row 2, enter this in cell F2 and copy it down:

=COUNTIFS(B:B, B2, C:C, C2, D:D, D2)

The number in each row is its group size. Sort the column from smallest to largest. Every row with a 1 is unique, and every row with a small number is nearly so. A pivot table gives the same count: put the three columns in the rows area and the count of any column in the values area.

How do you make the values coarser?

Each step below replaces an exact value with one that more people share. Then count again.

Column	Coarser value	Example
Birth date	Year, or an age band	1987-03-14 becomes 1987, or 35 to 39
Other dates	Month or year, or all dates moved by the same number of days	2026-04-02 becomes 2026-04
Postal code	The first digits only	90210 becomes 902
Job title	A broader group	"Senior ICU nurse" becomes "Nurse"
Amounts	A band or a rounded number	48,250 becomes 50,000
Rare values	One shared label for everything that appears too few times	"Other"

Moving every date by the same number of days keeps the gaps between dates, so a question such as "how many days between order and delivery" still has the right answer. It does not hide the pattern in the data, so use it when the intervals matter and the real dates do not.

For the staff table above, the birth year, the first three digits of the postal code and a broader job title give:

Row	Birth year	Postal code	Job title	Salary band
1	1987	902	Health worker	C
2	1987	902	Finance	D
3	1991	902	Health worker	C
4	1979	902	Health worker	B
5	1987	902	Health worker	C

Rows 1 and 5 now share a combination, and the other three rows are still unique. Coarser values help, and a small table needs more of them. The next section explains what to do about the rest.

What do you do about rows that are still unique?

You have three honest choices.

Make the values coarser still. Use an age band of ten years, or a region in place of a postal code, and count again.
Group or remove the rows that stand out. Combine rare values under "Other", or take out the few rows that are unique when the question does not need them.
Share fewer columns. If the question does not need the postal code at all, remove it, and the combinations get shorter and the groups larger.

There is no universal minimum group size. Some organizations set one, and the number depends on how sensitive the data is and who will receive it, so ask the person responsible for data protection in your organization what yours is. Write the number down before you start, so you do not adjust it to fit the result.

What are the limits of this check?

Free text can name people. Count it separately and remove or read it.
Extreme values stand out even in a large group: the single highest salary, the only patient over 90.
Other data sets change the answer. The more information a recipient already holds about the same people, the larger the groups need to be.
Usefulness falls as values get coarser. The aim is to keep what the question needs and no more.

Some rules set their own thresholds. The US federal rule on health information, for example, allows the first three digits of a postal code only for areas with more than 20,000 people, and it requires ages over 89 to be grouped into a single category. See the HIPAA identifiers, column by column.

How can DataAttendant help?

DataAttendant is a tool that runs in your web browser, on your own computer. For birth dates it can replace each date with its year, for postal codes it can keep only the first characters, and for amounts it can round or group them. It can also move dates by a fixed number of days, so that the gaps between dates stay the same. You see the result in a preview before you download the protected copy. It does not count group sizes for you, so the check above is still yours to do on the protected copy, and it does not decide whether a file is ready to share. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps.

Sources

Sweeney, L. (2002). "k-anonymity: a model for protecting privacy." International Journal on Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5), 557–570.
Sweeney, L. (2000). Simple Demographics Often Identify People Uniquely. Carnegie Mellon University, Data Privacy Working Paper 3. Its findings are summarized in how to remove personal details from a spreadsheet.
45 CFR § 164.514(b)(2)(i)(B) and (C) (postal codes, dates and ages over 89 under the identifier-removal method of the HIPAA privacy rule), read on law.cornell.edu on 28 October 2026.
The example table is invented.