# De-identification

URL: https://sellmydatatoai.net/glossary/de-identification

De-identification is the process of removing or altering information that identifies people in a dataset, so records cannot readily be linked to individuals.

De-identification is any process of removing the association between a set of identifying data and the person it describes, which is how [NIST](https://csrc.nist.gov/glossary/term/de_identification) defines it. In practice that means removing or transforming direct identifiers (names, email addresses, account numbers) and indirect identifiers (job titles, dates, locations).

## How does US law define de-identification?

US law sets de-identification standards in specific statutes. The [HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), at 45 CFR 164.514(b), allows two methods: Expert Determination that the risk of identification is very small, or Safe Harbor removal of 18 listed identifiers. HHS says de-identified health information is no longer protected health information.

The [CCPA](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV), at California Civil Code section 1798.140(m), treats information as deidentified only if the business takes reasonable measures, publicly commits not to re-identify it and contractually binds recipients to the same terms. Deidentified information is excluded from the CCPA's definition of personal information.

## How does UK law treat de-identification?

UK law has no defined de-identification standard, so under UK GDPR the result is either [anonymous information](https://sellmydatatoai.net/glossary/anonymization) outside the law or [pseudonymized](https://sellmydatatoai.net/glossary/pseudonymization) personal data inside it, as the [ICO's anonymization guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/) explains.

Our vetting requires a documented method and a re-identification test on a sample. See [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data).