Can Participants Withdraw Data That Have Already Been Anonymized?

What If the Participant Withdraws After Their Identity Has Been Removed?

A participant contacts the research team and asks for their data to be removed. There is just one problem: the dataset has already been anonymized, and the research team says it can no longer tell which record belongs to that participant.

Does the right to withdraw require researchers to find and delete the record anyway? Or has anonymization created a point after which individual removal is no longer possible?

The answer depends first on what researchers mean by anonymized. Data that are genuinely no longer linkable to an individual create a very different withdrawal problem from data that merely have names replaced with participant codes.

True Anonymization Can Make Individual Withdrawal Impossible

The First Question Is Whether the Data Are Actually Anonymous

Removing a Name Does Not Necessarily Make Data Anonymous

Research teams sometimes use anonymous, de-identified, coded, and pseudonymized as though they were interchangeable. They are not.

A dataset may display only participant numbers while another file still links those numbers to names. In that situation, the research team or another authorized party may still be able to determine which record belongs to a particular participant.

By contrast, if identifiers and linkage information have been irreversibly removed so that the participant's record can no longer be identified, an individual withdrawal request creates a practical problem: researchers cannot remove a record they cannot locate.

The terminology varies among jurisdictions and regulatory frameworks, so researchers should use the definitions applicable to their study rather than relying only on a database label.

Why Anonymization Changes the Withdrawal Question

Withdrawal of identifiable data requires researchers to know which information belongs to the participant. Once that link has genuinely disappeared, the mechanism needed to execute individual removal has disappeared with it.

SACHRP has explicitly recognized this limitation. Its recommendations note that withdrawal would not be feasible once biospecimens or data have already been fully de-identified, and it recommends informing participants of this limitation in advance when de-identification will prevent later withdrawal.

Common Rule Status and Ethical Commitments Are Not Always the Same Question

Under OHRP's interpretation of the U.S. Common Rule, research using fully de-identified or fully anonymized information does not involve human subjects as defined by that regulatory framework. SACHRP similarly explains that certain coded information may fall outside human-subject research when investigators cannot readily ascertain participants' identities.

That regulatory conclusion does not mean researchers can ignore promises made during consent. SACHRP specifically notes that even when a secondary use of de-identified or coded material is not human-subject research under the Common Rule, researchers and institutions still have an obligation to honor agreements made with participants about how their information or specimens would be used.

Researchers should therefore distinguish “the Common Rule no longer treats this as identifiable human-subject information” from “we are ethically free to disregard everything we promised.”

Anonymization Should Not Be Used to Defeat a Withdrawal Request

Timing matters. Suppose identifiable data remain linkable when a participant asks to withdraw them. Researchers should not simply erase the identifiers immediately and then announce that withdrawal is impossible because the data are now anonymous.

SACHRP has specifically described that strategy as ethically suspect when de-identification is performed in response to a withdrawal request solely to avoid honoring it. If researchers intend from the outset to anonymize withdrawn data and continue using them, SACHRP recommends that this possibility be disclosed during the original consent process, while also cautioning that an IRB should scrutinize such an approach carefully.

The Consent Process Should Explain the Point of No Return

If a study intends to anonymize data permanently, participants should understand what that means for later withdrawal. A statement such as “you may withdraw your data at any time” may be misleading if, after anonymization, the research team will be unable to identify which data belong to them.

SACHRP recommends explaining processes for and limitations to withdrawal when information or specimens will be retained for research. If anonymization will make later withdrawal infeasible, that is a consequential limitation rather than a technical footnote.

A clearer consent process might explain that participants may request withdrawal while information remains linkable, but after irreversible anonymization the researchers may no longer be able to identify and remove an individual's contribution.

Anonymization Is Different From Analysis

Researchers should not confuse two different reasons why withdrawal may become difficult. One concerns identity: the data can no longer be connected to the participant. The other concerns research progression: the data may already have been incorporated into analyses or derived results.

A dataset can remain identifiable even after analysis begins, and a dataset can be anonymized before substantial analysis occurs. The question of whether data can be withdrawn after analysis has begun therefore requires a separate assessment.

FDA-Regulated Trial Data Create a Different Limitation

In an FDA-regulated clinical trial, the inability to remove accrued data does not depend on anonymization. FDA policy requires already-accrued trial data from participants who discontinue participation to remain part of the study data.

Researchers should therefore identify why withdrawal is limited. “We cannot identify your data anymore” and “the regulatory framework requires us to retain the data” are not interchangeable explanations.

Do Not Promise More Control Than the Data Architecture Can Deliver

The withdrawal language in a consent form should reflect the actual data workflow. If a linkage key will be destroyed after quality control, say what that means. If data will remain coded for years, do not describe them as permanently anonymous. If copies will be shared with approved secondary researchers, explain relevant limits on retrieving those copies.

This is one reason the broader question of what happens to data after participant withdrawal should be considered during study design rather than improvised when the first withdrawal occurs.

When the Link to the Participant Has Already Been Destroyed

The limitation is genuine because anonymization occurred according to the approved process before the withdrawal request. The result would be ethically different if the team still had identifiable data when the participant requested withdrawal and anonymized them specifically to avoid acting on the request.

Common Mistakes About Withdrawing Anonymized Data

Know Whether You Can Still Find the Participant's Data

When someone asks to withdraw anonymized data, do not answer from the dataset's filename. Trace the actual data architecture and determine whether any retained mechanism can still connect the participant to their information.

When Someone Asks to Withdraw Anonymized Data

Questions About Withdrawal After Anonymization

You Cannot Remove a Record You Can No Longer Identify

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.