Understanding how to identify, anonymize, and manage datasets containing personal and sensitive information allows for responsible research practices, and to prepare data for secure sharing and reuse.
Related resources for data protection:
Examples of personal and sensitive data
Check out the definitions of personal and sensitive data, and more on the laws for privacy in research.
Before handling personal or sensitive data, or if in doubt, contact the Human Research Ethics Committee (HREC).
- Direct identifiers
- Ex.: Name; Civil Identification Number; Passport number; Address details; Email Address; Phone number; Bank Account; Driver’s license number; Vehicle identifiers and license plate; Social Security Number; Health Card Number; Medical Record Number; Personal Device identifier and serial number; Biometrics (e.g. fingerprints, voice, face); Genetic information; etc. …
- Indirect identifiers
- Ex.: Gender; Date of birth or age; Date of event (e.g. admission, surgery, discharge); Geographic range (e.g., zip code, building, region); Ethnic origin; Nationality, place of origin; Language; Aboriginal Identity; Visible minority status; Job title, work unit, dept., etc.; Marital Status; Education level; Years of schooling; Total revenue; Religious beliefs; Internet Protocol (IP) address number; etc. …
Note: A combination of indirect identifiers (sometimes called quasi-identifiers) can identify an individual, even when none can do so alone.
Main techniques with examples
Personal data is pseudonymized when it is replaced by a code (pseudonym), while it is anonymized* when all identifying data is removed. Exhaustive definitions: EPFL Data anonymization.
Also check other examples of techniques and further use examples.
*Anonymization is often considered “irreversible” or “definitive”, compared to pseudonymisation, which remains reversible. But complete irreversibility cannot be guaranteed, especially for highly specific data (e.g. genetic or neuroimaging data, etc.).
- K-anonymity (Anonymization)
- • Generalize (replace specific values with ranges)
• Suppress (remove attributes)
Ex.: In a medical records dataset, instead of showing a specific age like 28, the age is generalized to a range like 20-30. Each individual cannot be distinguished from at least K-1 other individuals based on indirect identifiers like age (but could be gender, country, zip code, etc.). - L-diversity (anonymization)
- • Diversify sensitive attributes within each equivalence class
Ex.: In the K-anonymized medical records dataset, if there are 10 people in the 20-30 age group, L-diversity means that there are at least “L” different values for a sensitive attribute (e.g., diabetes diagnosis) for which you’re anonymizing. - T-closeness (Anonymization)
- • Maintain similar distribution of sensitive attributes across equivalence classes
• Use in combination with K-anonymity and L-diversity
Ex.: In the L-diverse medical records dataset, if 10% of all records (the entire dataset) show a diabetes diagnosis, then each indistinguishable group of records should also contain close to 10% diabetes cases. - Differential Privacy (Anonymization)
- • Add calibrated random noise to analysis results
• Calibrate noise to ensure output insensitivity to individual records
Ex.: When analyzing salaries in a company, random noise (e.g., Laplace or Gaussian noise) is added to the average salary result. The reported average is the true average plus or minus a random amount, so that the presence or absence of any one person’s salary doesn’t significantly affect the result. - Tokenization (Pseudonymization)
- • Replace sensitive data with reversible, randomly generated tokens
• Store mapping between tokens and original data securely
Ex.: In a customer database, PIIs like names and social security numbers are replaced with randomly generated tokens. The mapping between the tokens and the original PII is stored securely and separately from the tokenized data. - Hashing (Pseudonymization)
- • Replace identifiers with hashed values
• Store mapping between hashed values and original identifiers securely
Ex.: In a user database, user IDs are hashed using a one-way cryptographic hash function (e.g., SHA-256). The hashed IDs are used as pseudonyms in data analysis tasks. The mapping between the hashed IDs and the original user IDs is securely stored and managed. - Secure Multiparty Computation (Encryption)
- • Cryptographic protocols (e.g., secret sharing, homomorphic encryption) enable joint computation on distributed private data
Ex.: Multiple parties, each holding their own private data (e.g., hospitals with patient records), want to compute a joint function (e.g., average age of all patients) without revealing their data to each other. SMC protocols enable this computation while keeping each party’s input private. - Homomorphic encryption
- • Use encryption schemes allowing computations on encrypted data
• Perform computations on encrypted data to enable outsourcing to untrusted parties
Ex.: A researcher computes the average of encrypted salaries stored in a cloud database via computations (like addition) performed directly on encrypted data, producing an encrypted result. When decrypted, this result matches the result of performing the same computation on the unencrypted data.
Tools table
This table lists some software useful for manipulating personal/sensitive data for various scopes (collection, transcription, encryption, anonymization, sharing, etc.).
- The researchers are responsible for choosing and operating any tool, in compliance with the ethics validation and the laws. To clarify the responsibilities, contact the HREC at research@epfl.ch.
- Unless explicitly stated, in principle EPFL does not develop, maintain, grant licenses or access, nor offers specific support for the tools listed in the table.
- The EPFL Library does not assume any responsibility for the veracity of the information, collaboratively gathered within the Swiss Research Data Support Network.
