# Re-identification risk

URL: https://sellmydatatoai.net/glossary/re-identification-risk

Re-identification risk is the likelihood that people in a de-identified or anonymized dataset could be identified again, alone or by combining it with other information.

Re-identification risk is the chance that de-identified data could be attributed again to the people it describes, using the data alone or by linking it with other information. [NIST](https://csrc.nist.gov/glossary/term/re_identification) defines re-identification as a process by which information is attributed to de-identified data in order to identify the individual to whom it relates.

## How does US law measure re-identification risk?

US law measures re-identification risk most precisely in HIPAA. Under the Expert Determination method in [45 CFR 164.514(b)(1)](https://www.law.cornell.edu/cfr/text/45/164.514), a qualified expert must find that the risk is very small that the information could be used, alone or with other reasonably available information, to identify a person. [HHS guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html) says no single numerical level universally meets that test, and that the risk in de-identified data is very small but not zero.

NIST's [SP 800-188](https://csrc.nist.gov/pubs/sp/800/188/final), published in September 2023, recommends re-identification studies and notes that tools which only mask personal information may not be enough. If you hold UK data, the [ICO's guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/) tests for singling out, linkability and inference, and asks whether a motivated intruder could identify someone.

## Why is re-identification risk higher for AI training data?

Re-identification risk is higher for AI training data because free text, voices and code carry indirect identifiers that simple redaction misses, and large models can memorize rare strings from their training data. Our [seller vetting](https://sellmydatatoai.net/how-we-vet) runs a re-identification test on a sample. See [de-identification](https://sellmydatatoai.net/glossary/de-identification), [anonymization](https://sellmydatatoai.net/glossary/anonymization) and [de-identification for AI training data](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data).