What Are Direct and Indirect Identifiers in Research Data?

Which Research Variables Are Direct Identifiers and Which Are Indirect?

A participant's name is clearly identifying. Age seems less obvious. What about occupation, postcode, exact interview date, photograph, student number, or a rare diagnosis?

Researchers often divide identifying information into direct and indirect identifiers to make this problem more manageable. The distinction is useful, but it is not as simple as memorising two universal lists.

Some information points to a person relatively directly. Other information becomes identifying only through context, combination, or linkage. The same variable can also carry very different identification risk in different datasets.

Direct Identifiers Point to a Person; Indirect Identifiers Narrow Down Who They Are

The Difference Is About How Information Leads to Identity

Direct Identifiers Provide a Relatively Immediate Route to a Person

A direct identifier identifies or strongly points to a particular individual without requiring a substantial combination of other research variables.

Common examples include:

• full name;
• personal email address;
• telephone number;
• student or employee number linked to institutional records;
• government-issued identification number;
• medical record number;
• account number;
• some biometric identifiers;
• full-face photographs; and
• other unique identifiers that directly correspond to an individual.

Not every framework labels exactly the same items "direct identifiers." The practical idea is that these variables provide a relatively short route from the data to the person.

Indirect Identifiers Require Context, Combination, or Linkage

An indirect identifier, sometimes called a quasi-identifier in statistical disclosure contexts, may not reveal a person's identity by itself. Instead, it narrows the population or becomes identifying when combined with other information.

Common examples may include:

• age or date of birth;
• sex or gender;
• occupation;
• job title or organisational role;
• geographic area;
• nationality or ethnicity;
• educational background;
• marital or household characteristics;
• dates associated with events;
• rare diagnoses or experiences; and
• other demographic or contextual characteristics.

The ICO illustrates indirect identification using combinations of significant criteria such as age, occupation, and place of residence. The important point is the combination: information that does not directly name someone can still distinguish them when connected with other information.

Indirect Does Not Mean Unimportant

The word "indirect" can sound reassuring, as though these variables are inherently safe. They are not.

HHS guidance on HIPAA de-identification illustrates how seemingly ordinary information can contribute strongly to identification. Under HIPAA's Safe Harbor method, specified geographic detail and most elements of dates directly related to an individual are among the information that must be removed, along with names and numerous conventional identifiers. The rule also requires that the covered entity have no actual knowledge that the remaining information could identify an individual alone or in combination with other information.

HIPAA is a specific US health-information framework, so its list should not be copied into every research protocol as a universal taxonomy. It does, however, demonstrate why dates, geography, and unique characteristics deserve attention alongside obvious identifiers.

Several Weak Identifiers Can Become One Strong Identification Pattern

Consider four variables:

• age: 53;
• occupation: veterinarian;
• municipality: a small town; and
• sex: female.

None necessarily identifies a participant independently. If only one 53-year-old female veterinarian lives or works in that town, their combination may effectively single her out.

This is why researchers should assess whether participants can be identified without names. The identifying unit may be a pattern rather than a field.

Direct and Indirect Are Not Always Permanent Labels

The classification of an identifier can depend on who holds it and what systems are available.

A random-looking employee number may mean nothing to an outside researcher. To the employer with access to a personnel database, the number may immediately reveal a person's identity. A vehicle registration number may similarly identify a vehicle directly while identifying its owner through access to registration information.

The ICO specifically notes that identifiers such as vehicle registration numbers, passport numbers, and combinations of significant criteria can enable indirect identification when connected with additional information.

Researchers should therefore use the direct/indirect distinction as an analytical tool rather than assuming that every variable carries one immutable label in every environment.

Unique Codes Need Special Treatment

Study IDs are deliberately created to replace direct identifiers during research. Whether they should be treated as identifying depends partly on the surrounding system.

If P004 can be connected to a participant using a code key, the code participates in an identity-linkage mechanism. It may be meaningless to an analyst who lacks the key while remaining linkable to the research team that holds it.

Separating identifiers and linkage information can therefore be valuable even though it does not automatically make the underlying data anonymous. Researchers may need to consider when participant identifiers should be stored separately.

Context Determines How Revealing an Indirect Identifier Is

Suppose a dataset records participants' occupations.

"Teacher" may reveal little in a large national survey. "Only pediatric neurosurgeon at Hospital X" is another matter. Likewise, a province may contain millions of residents, while a tiny barangay, postcode, or institutional unit may narrow the population substantially.

The identifying power of an indirect identifier depends on factors such as:

• how detailed the variable is;
• how common or rare the value is;
• the size of the relevant population;
• which other variables accompany it;
• what outside information exists; and
• who receives the data.

This is why demographic information can accidentally identify participants in some studies while remaining relatively non-distinctive in others.

Identifiers Can Hide in Unstructured Data

Direct and indirect identifiers are not confined to tidy spreadsheet columns.

An interview participant may name their employer. A diary may contain an exact address. A clinical narrative may mention an unusual occupation. A photograph may reveal a face or licence plate. An audio recording may contain a recognisable voice. A video may show a distinctive workplace.

HHS guidance explicitly notes that HIPAA identifiers must be addressed whether they appear in structured fields or free text. It gives information-rich clinical narratives as an example of material that can contain contextual information allowing identification.

Qualitative researchers therefore need to inspect informational content, not merely remove columns from a spreadsheet.

Direct and Indirect Identifiers Differ From Sensitive Information

Identifiability and sensitivity are related but separate dimensions.

A person's telephone number may identify them without revealing a sensitive research finding. A highly sensitive opinion may reveal very little about identity if it is genuinely disconnected from the person who expressed it.

When the two occur together, the consequences of identification can increase considerably. Researchers should therefore assess both the likelihood of identification and the consequences if identification occurs.

A Practical Taxonomy Helps, but It Is Not a Universal Legal List

Use such classifications to structure a risk assessment, not as a substitute for checking the definitions imposed by your ethics body, institution, jurisdiction, or data-sharing framework.

How Indirect Identifiers Can Reconstruct an Identity

The exercise shows why separating direct identifiers is useful but not sufficient for every disclosure problem. The remaining variables still need their own identifiability assessment.

Common Mistakes About Direct and Indirect Identifiers

Review Identifiers as a System, Not as Individual Columns

Start by identifying obvious direct identifiers. Then examine what remains collectively. The second stage is where many disclosure risks become visible.

The practical goal is not to purge every potentially identifying variable regardless of scientific value. It is to collect and retain what the research genuinely requires, understand how those variables interact, and protect them in proportion to the identification risk they create.

Audit Both Direct and Indirect Identifiers

Frequently Asked Questions About Direct and Indirect Identifiers

Indirect Identifiers Matter Most in Combination

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.