How does de-identification work?
De-identification means removing or changing the details that point to a specific person, such as names, emails, phone numbers and account numbers, so the records can be used without revealing who they are about. It lowers privacy risk but rarely removes it completely, especially in free-text email and chat.
What does de-identification actually do?
In plain terms, it breaks the link between a record and the person it describes. Federal guidance from NIST describes two kinds of details to handle. Direct identifiers name someone outright: name, email address, phone number, ID numbers. Quasi-identifiers do not name anyone alone but can point to a person when combined, such as a job title, a city and a start date.
The usual steps are to remove or replace direct identifiers, and to generalize or blur quasi-identifiers, for example turning an exact date into a month, or a job title into a department.
Credit for Bellwether Foods on PO 77-20419. Call me at (805) 555-0142.
Credit for COMPANY_01 on PO ACCOUNT_01. Call me at PHONE_01.
What do buyers actually want from the records?
Most owners ask about privacy first, and the short answer is that buyers want the logic, not the names. AI developers are buying how work gets done: how a problem was spotted, escalated, fixed and closed. Who was involved doesn't help them, and the programs we list say they remove or replace personal details before data reaches the AI lab.
An example: a billing ticket where Maria at Acme Logistics was double-charged $12,400 could reach the buyer as Jennifer at Best Flight double-charged $3,402, with the same steps taken to fix it. The names, the company and the amount are replaced; the sequence of work stays. Each buyer's profile on this site links to that buyer's own description of how it handles data.
What does that look like in business records?
For email, chat and tickets, common techniques include:
- Replacing names with consistent placeholders, so "Maria" becomes "Person 14" everywhere and conversations still make sense.
- Removing email addresses, phone numbers, street addresses and account or card numbers.
- Replacing customer and partner company names with placeholders.
- Removing signatures, attachments of IDs and photos.
- Coarsening dates and locations where they could pinpoint a person.
- Dropping whole messages that are clearly personal (medical, family, HR matters).
Why isn't it perfect?
Free text is hard. Automated tools miss things, and people reveal themselves through context: "the only engineer in our Denver office" identifies someone without a name. Reporting on 2026 deals has quoted a lawyer who advises AI startups noting that emails and calendars can still hold private details after scrubbing.
Some shortcuts do not work. The FTC has warned that hashing an identifier (turning it into a scrambled code) does not make data anonymous, because the same input always produces the same code and can be used to track a person. NIST guidance recommends measuring re-identification risk and testing it, not just running a masking tool.
Are there legal standards?
For health information, HIPAA sets two recognized methods. Under Safe Harbor, a specific list of identifiers is removed, including names, small geographic areas, most dates and contact details, and the holder has no actual knowledge the rest could identify someone. Under Expert Determination, a qualified expert documents that the risk of identification is very small.
State privacy laws use a different test. California's law and several others treat data as deidentified only if it cannot reasonably be linked to a person and the business takes extra steps: reasonable technical measures, a public commitment not to re-identify, and contracts requiring recipients to follow the same rules. Data that meets HIPAA's test may still count as personal information under California law in some cases. Ask your lawyer which standard applies to you.
Who should do the work, and how do I check it?
There are three common options. Your own team can do it, which keeps the raw data in-house but takes time and skill. A specialist service provider can do it under a confidentiality agreement. Or the buyer can do it after delivery, which means the buyer sees the raw data first; that choice deserves extra caution and stronger contract terms.
Whichever you choose, check the output. Pull a random sample of cleaned records and read them yourself, looking for names, nicknames, signatures, phone numbers and personal stories that slipped through. If you find problems, fix the process before the full delivery, not after. NIST guidance also suggests documenting the method used, which helps if questions come up later.
What should the contract say?
Whoever does the work, put the rules in writing. Common terms include:
- Who performs the de-identification and by what method.
- A promise by the buyer not to try to re-identify anyone.
- Limits on passing the data to others, who must accept the same rules.
- Duty to delete and report anything identifying that is found later.
- Your right to review a cleaned sample before full delivery.
Common questions
Will the buyer see our customers' and employees' names?
It shouldn't. Buyers want the steps of the work, not who did it, and the programs we list say they replace names, companies, contact details and amounts before the data reaches the AI lab. Confirm in the contract who does this and ask to review a cleaned sample.
Is de-identified data the same as anonymous?
Not quite. De-identification lowers the risk of identifying someone; it rarely makes it zero, especially in free text.
Can I just run a find-and-replace on names?
That is a start but usually not enough. Context, signatures, nicknames and attachments can still identify people.
Does the buyer do the scrubbing?
Sometimes. Some buyers or service providers remove personal details for you. Check who does it and how, and review the result.
Does HIPAA apply to my business records?
Only if they include protected health information you hold as, or on behalf of, a covered entity. Clinical records are handled on our sister site, licensemydata.com.
Sources
- NIST SP 800-188, De-Identifying Government Datasets: Techniques and Governance (Sept 2023), accessed 2026-10-15
- Guidance Regarding Methods for De-identification of Protected Health Information (HHS.gov), accessed 2026-10-15
- No, hashing still doesn't make your data anonymous (FTC Technology Blog, July 24, 2024), accessed 2026-10-15
- Finding the Delta: Understanding the Differences in the State Deidentification Standards (National Law Review, May 17, 2022), accessed 2026-10-15
- Deidentified Under HIPAA, But Regulated Under the CCPA (Goodwin, June 15, 2022), accessed 2026-10-15
- AI labs are buying data from dead startups to train their models (MIT Technology Review, Oct 13, 2026), accessed 2026-10-15
General information, not legal, tax or financial advice.