Methods depend on the data and proposed use. Removing names may help, but identifying information can remain in free text, attachments, metadata and combinations of fields.
Assign responsibility
Ask who transforms the records, who validates the result and who can access the original material. Document the method and residual risks.
Avoid an absolute promise
Do not claim a dataset is anonymous without an appropriate assessment. De-identification does not automatically resolve copyright, confidentiality or contractual restrictions.
What to record before deciding
Keep the written scope, official provider source, unresolved questions and the person responsible for each check. Treat a marketing claim as a claim until it is reflected in the agreement. A directory entry does not approve the transaction or establish your rights to share the records.
Sources & further reading
- FTC: Protecting personal information
- ICO: Anonymisation guidance
- U.S. Copyright Office: Copyright basics
Provider statements are attributed claims, not audited outcomes. Reviewed 19 October 2026.