What are common mistakes with anonymised data?

Where anonymisation goes wrong in practice

The biggest mistake is treating anonymisation as a name-stripping exercise. If direct identifiers are removed but dates, locations, job roles, device IDs, postcode fragments, or other quasi-identifiers remain, the dataset can still be linked back to a person. That risk rises sharply when the data is reused outside the original context or combined with public or commercial datasets.

Another common failure is confusing pseudonymisation, masking, tokenisation, and true anonymisation. These techniques do not all provide the same protection, and some only reduce exposure temporarily. A dataset that still supports re-identification through linkage, inference, or repeated release should be treated as sensitive data with controls, not as safe-to-share output.

Why linkage and context change the risk

Re-identification usually happens because one dataset is weak on its own but becomes revealing when joined with another source. Even a small number of attributes can uniquely identify someone in a large population, especially when the data includes rare events, free-text fields, precise timestamps, or geographic detail. The practical lesson is that anonymisation quality depends on the whole environment, not just the export step.

Release decisions should also account for the purpose of the recipient and the likelihood of downstream enrichment. A dataset shared for analytics may later be repurposed, copied into a less controlled environment, or cross-referenced with other records. That is why formal methods such as k-anonymity, l-diversity, t-closeness, differential privacy, masking, and synthetic data are chosen based on the use case, not on a generic idea that “anonymised” is always enough. NHI Management Group’s Privacy-Enhancing Technologies Guide is useful when you need to match the control to the disclosure risk.

What governance should stay in place after anonymisation

Good anonymisation is not a one-time label applied before distribution. It needs data minimisation, attribute review, release approval, and periodic re-testing as new external data becomes available. Teams should be especially cautious with quasi-identifiers, high-cardinality fields, and datasets that can be linked across time, because those are the usual paths back to identity.

Governance also means knowing when a dataset is not anonymous enough for unconstrained sharing. If re-identification remains plausible, the safer position is to manage the dataset as protected information with documented access rules, retention limits, and accountability for further sharing. That is why privacy controls and release discipline matter even when a dataset no longer contains obvious identifiers. NHI Management Group’s Top 10 Privacy Compliance Mistakes is a useful companion for the governance failures that often sit around anonymised data handling.

Risk and Threat Considerations

Anonymised data fails most often through inference, linkage, and re-use, not through obvious identifier leakage. The practical threat is that a dataset thought to be safe can still expose individuals, trigger privacy violations, or create a false sense of control that encourages broader sharing than the data deserves.

Failure mechanism: Retained quasi-identifiers, rare attribute combinations, and external data sources combine to make re-identification feasible even when direct identifiers have been removed.

Impact: Individuals can be singled out or re-associated with sensitive records, and the organisation may lose the ability to justify uncontrolled publication or secondary use of the dataset.

Practitioner Guidance

What to verify: Before sharing, test the dataset against realistic linkage attacks, not just internal naming rules. Check whether the remaining fields would still identify someone if paired with commonly available reference data, and treat free text, timestamps, and small cohorts as high-risk.

Decision rule: If the dataset can only be made safe by removing most useful detail, do not assume the answer is “publish anyway.” Either reduce the detail further, apply a stronger privacy-preserving method, or keep the data under governed access rather than treating it as publicly anonymous.

Practitioner takeaway: The label “anonymised” should be earned by resistance to re-identification, not by the absence of names; if linkage risk remains, the dataset still needs controls.

Related resources from NHI Mgmt Group

• Why is it important to integrate identity and data governance?
• What are the common mistakes teams make when building data retention and minimization programmes?
• What are the common mistakes teams make when they rely on regex for sensitive data discovery?
• What are common mistakes with location data privacy?