What is de-identification?
De-identification is the process of removing, masking, or altering personal identifiers in data so an individual cannot be readily identified. It covers techniques like redaction, masking, pseudonymization, and generalization. Common identifiers include names, emails, phone numbers, addresses, dates, and account numbers. It reduces re-identification risk but rarely eliminates it.
De-identification is a core data-privacy practice. The goal is simple: keep data useful while making it hard to tie back to a real person. This page explains what it means, the main methods, how it differs from anonymization and pseudonymization, and where the limits are.
De-identification approaches compared
| Method | What it does | Reversible? | Keeps data useful for |
|---|---|---|---|
| Redaction | Removes the identifier or replaces it with [LABEL] | No | Sharing, logs, LLM prompts |
| Masking | Hides part of a value, keeps the format | No | Display, support, partial verification |
| Pseudonymization | Swaps identifiers for tokens with a key | Yes, with the key | Joining records, longitudinal analysis |
| Generalization | Lowers precision (year, region) | No | Statistics, reporting |
| Anonymization | Alters data so re-identification is not feasible | No | Open data, research (when truly achieved) |
What does de-identification mean?
De-identification means changing data so a person cannot be readily identified from it. You either remove identifiers, hide them, or swap them for stand-in values. The data stays usable for analysis, testing, or training, but the link to a specific human gets weaker.
There are two broad approaches. The first is suppression and redaction: you delete or black out the identifier. The second is transformation: you replace or generalize the identifier so the record still works but no longer points to one person.
De-identification is a spectrum, not a switch. Removing a name lowers risk. Removing a name, email, phone, and exact birth date lowers it much more. How far you go depends on the data, who can access it, and what other data they could combine it with.
What are the main de-identification methods?
Most de-identification programs combine several techniques. The right mix depends on whether you need to keep the data readable, reversible, or statistically useful.
- —Redaction: remove the identifier entirely or replace it with a placeholder like [EMAIL] or [NAME].
- —Masking: hide part of a value while keeping its shape, such as turning 4111 1111 1111 1111 into **** **** **** 1111.
- —Pseudonymization: swap an identifier for a consistent token or fake value, with a separate key that can reverse it.
- —Generalization: reduce precision, such as keeping the birth year instead of the full date, or a region instead of a street address.
- —Suppression: drop entire fields or rare records that are too identifying to keep.
- —Synthetic substitution: replace real values with realistic fake ones for test or demo data.
What counts as a personal identifier?
Before you can de-identify data, you have to find the identifiers. These split into two groups. Direct identifiers point to one person on their own. Quasi-identifiers are not unique alone but can single someone out when combined.
The table below shows common direct identifiers and how a detector typically labels them.
- —Direct identifiers: full name, email, phone number, account or card number, government ID, exact address.
- —Quasi-identifiers: ZIP code, birth date, gender, job title, employer, rare diagnosis.
- —Indirect signals: URLs, IP addresses, device IDs, and timestamps that can be linked back to a person.
How is de-identification different from anonymization and pseudonymization?
These terms get mixed up often, and the difference matters legally and technically. De-identification is the umbrella process. Anonymization and pseudonymization are points on its spectrum.
Anonymization is the strongest end: data is altered so no one can be re-identified, even with extra data, and the process is not reversible. True anonymization is hard to prove and easy to overclaim. Pseudonymization is reversible by design, because a key exists to map tokens back to real people. Under GDPR, pseudonymized data is still personal data.
What are the limits and risks of de-identification?
De-identification reduces re-identification risk. It does not promise the risk is zero. The big threat is linkage: an attacker combines your de-identified dataset with another source to re-attach identities. Famous cases re-identified people from supposedly anonymous medical and search records using just a few quasi-identifiers.
Treat de-identification as data minimization, not a compliance certificate. Detection can miss identifiers in messy text, free-form notes, or 30-plus languages. Match the technique to the risk, keep humans in the loop for high-stakes data, and re-check as new linkable data appears.
How does Sanitext relate to de-identification?
Sanitext is a self-serve API that handles the detection and redaction steps of de-identification. POST text to /v1/detect and it returns entity spans with a label, byte offsets, a score, and the matched text. POST to /v1/redact and it returns the same text with each span masked as [LABEL].
It detects names, emails, phone numbers, addresses, dates, URLs, account and card numbers, and secrets like API keys across 30-plus languages. The model runs on our own infrastructure, so raw text never goes to a third-party LLM and we log only counts and timings.
Sanitext is a redaction and data-minimization aid, not an anonymization or compliance guarantee. It automates finding and masking identifiers. Decisions about generalization, key management, and acceptable re-identification risk stay with you.
FAQ
Is de-identification the same as anonymization?+
No. De-identification is the broad process of removing or obscuring identifiers. Anonymization is its strongest, irreversible end where no one can be re-identified even with extra data. Most de-identified data falls short of true anonymization and may still carry re-identification risk.
Does de-identification make data fully anonymous?+
Not by default. De-identification lowers re-identification risk but rarely removes it. Attackers can re-link records by combining quasi-identifiers like ZIP code, birth date, and gender with outside data. Treat de-identification as data minimization, not a guarantee of anonymity or compliance.
What identifiers should de-identification remove?+
At minimum, direct identifiers: names, emails, phone numbers, exact addresses, account and card numbers, and government IDs. For higher protection, also handle quasi-identifiers such as full birth dates, precise locations, and rare attributes that can single someone out when combined.
Can de-identification be automated?+
Yes. Tools like Sanitext detect identifiers in text and return spans or redacted output via API. Automation handles detection and masking at scale, but choices about generalization, reversibility, and acceptable risk still need human judgment, especially for regulated data like health records.
De-identify text in 60 seconds
Sign up free for a one-time 300K characters, get an API key, and call /v1/redact to mask names, emails, phones, and more across 30-plus languages. No card needed. Try the playground or read the docs.
Get your free API key