03 · What You Need to Know
Identifiability Depends on Context, Not Just on Visible Names
Anonymous, de-identified, coded, and pseudonymized are not interchangeable
Researchers often use these terms casually, but they can describe materially different states of information and can carry different meanings under particular legal or institutional frameworks.
| Term |
General idea |
Important qualification |
| Identified data |
Information is directly connected to a known individual |
Direct identifiers may be obvious |
| Coded data |
Direct identity is replaced with a code |
A key may permit reconnection to the individual |
| Pseudonymized data |
Identity is separated or replaced using additional information |
The information may remain identifiable when the additional information is available |
| De-identified data |
Measures have been taken to reduce the association between information and individuals |
Residual re-identification risk can remain |
| Anonymous data |
Information cannot reasonably be linked to identifiable individuals under the applicable standard |
Whether this threshold is met depends on context and the governing framework |
Researchers should use the terminology required by their ethics, institutional, methodological, and legal framework rather than assuming that one definition applies everywhere.
Re-identification can occur through linkage
A dataset may contain no names yet include attributes that correspond with information available elsewhere. Linking the two sources can sometimes reveal identities.
NIST defines re-identification risk as the likelihood that a third party can re-identify data subjects in a de-identified dataset. Its de-identification guidance recommends considering external information available to potential recipients and evaluating the disclosure risks created by a proposed data release.
HHS guidance under HIPAA similarly recognizes that identification can occur through information used alone or in combination with other reasonably available information.
Uniqueness can make ordinary information revealing
Imagine a dataset containing 50,000 university students. "Male, age 20, undergraduate" probably describes many people.
Now imagine a study of eight school principals in a remote province. A record describing "the only female principal over 60 who has led the same school for 27 years" may be recognizable locally even without a name.
Identification risk therefore depends partly on population size, uniqueness, background knowledge, and the granularity of the variables.
Rare cases are especially difficult to anonymize
Research often values unusual cases precisely because they are unusual. Unfortunately, unusual cases can also be easier to identify.
A rare disease, exceptional career trajectory, unusual accident, distinctive family configuration, highly specific job title, or singular institutional event may function almost like an identifier when few people fit the description.
Removing names while preserving every distinctive detail can therefore preserve much of the identification risk.
Qualitative quotations can be searchable
Verbatim quotations deserve particular attention. A participant may have used the same distinctive sentence in a public speech, social-media post, blog, interview, court record, organizational document, or other searchable source.
Even where an exact search does not reveal the speaker, the content of the quotation may identify their employer, role, family circumstances, neighborhood, diagnosis, or a unique event.
Qualitative anonymity therefore depends on more than changing "John" to "Participant 4."
Watch Out
A quotation can function as an identifier even when it contains no name. Assess what the words reveal and whether the same or closely related language exists in public or accessible sources.
Geography can rapidly narrow the field
Location information is often analytically valuable. It can also make records distinctive.
Country-level information may identify almost nobody in a large international study. A barangay, village, small school, specialized clinic, or exact workplace may reduce the possible identities dramatically.
Location also interacts with other variables. Age plus occupation plus municipality may reveal far more than any one of those fields alone.
Time can be identifying too
Exact dates can connect research records with publicly documented events, hospital admissions, organizational announcements, accidents, court proceedings, competitions, news reports, or social-media activity.
This is one reason formal de-identification standards may require modification or suppression of dates in particular contexts. HIPAA's Safe Harbor method, for example, imposes detailed restrictions on elements of dates directly related to individuals rather than focusing solely on names.
Images, voices, and metadata create additional routes to identity
Research information is not limited to spreadsheet cells.
A photograph can reveal a face, uniform, workplace, landmark, document, or computer screen. Audio can reveal a voice or background information. Video combines multiple identifying channels. Files may also contain metadata such as author information, device information, timestamps, or location data.
NIST's de-identification guidance explicitly recognizes that de-identification problems extend to free-format text, multimedia, and imagery.
The recipient changes the risk
Identifiability is partly relational. Information may be meaningless to a stranger but instantly recognizable to someone from the participant's workplace, village, research site, or professional community.
HHS's Expert Determination framework illustrates this contextual approach by requiring consideration of the anticipated recipient and other information reasonably available to that recipient when assessing whether identification risk is very small.
This is one reason a dataset judged acceptable for controlled access may not necessarily be appropriate for public release or unrestricted processing elsewhere.
Technology and available information change over time
Anonymity is not always a permanent property. New public datasets, improved search, better record linkage, increased computational power, or new inference techniques can alter what can be learned from information that once appeared difficult to connect.
HHS notes that de-identification practitioners may consider changes in technology, social conditions, and available information when determining how long a de-identification assessment remains appropriate. NIST similarly recommends risk-based governance rather than assuming that one transformation permanently eliminates disclosure risk.
Sensitivity can remain even when nobody is identifiable
Identifiability is only one reason research information may require protection.
Suppose a dataset has been robustly anonymized at the individual level but describes a very small community's experience of stigmatized illness, illegal activity, political persecution, environmental contamination, or discrimination. The findings might create group-level harms even if no single participant can be identified.
Research information can also remain commercially sensitive, culturally restricted, security-sensitive, proprietary, embargoed, or contractually confidential without containing identifiable personal information.
Identifiable information
Information that can reasonably be connected to a particular person under the relevant circumstances.
Sensitive information
Information whose disclosure could create privacy, ethical, social, commercial, cultural, security, contractual, or other consequences, whether or not a particular person is identifiable.
This distinction is particularly important when deciding whether apparently anonymous information belongs in an AI system.
De-identification does not necessarily eliminate disclosure risk
NIST emphasizes that organizations should assess the risks created by releasing de-identified data and choose appropriate technical and governance measures. Its guidance recognizes several possible sharing models, ranging from public release to protected enclaves, rather than assuming that every de-identified dataset should simply be released.
HHS likewise states that properly de-identified health information under HIPAA still carries a very small but nonzero possibility of re-identification.
The practical point is not that anonymity is impossible. It is that anonymity should be assessed rather than declared.
AI introduces another disclosure context
When apparently anonymous research information is submitted to an AI service, the relevant question is not only whether you personally can identify anyone from the file. Consider what information the service receives, what contextual details remain, how the provider handles the content, and whether the research rules permit that processing.
Simply following the procedure of removing names before using AI is therefore insufficient when the remaining information still carries meaningful identification or sensitivity risks.
07 · A Quick Checklist
Before Calling Research Information Anonymous
Before treating information as anonymous or safe for external AI processing, check:
Look for direct identifiers, indirect identifiers, codes, pseudonyms, and any remaining means of reconnecting records to participants.
Identify rare or unique combinations of age, occupation, location, institution, diagnosis, events, relationships, or other characteristics.
Review free text and quotations for distinctive details or searchable language.
Inspect images, audio, video, filenames, and metadata for additional identifying information.
Consider what public records, websites, social media, publications, institutional records, or other datasets could be linked to the information.
Consider what people with local, organizational, clinical, or disciplinary knowledge might recognize.
Assess whether the information remains sensitive at a group, community, institutional, commercial, cultural, contractual, or security level even if individuals are not identifiable.
Verify separately that your ethics approval, consent, institution, data agreements, and AI environment permit the proposed processing.
