Anonymisation
Changing data so that individuals can no longer be identified, by anyone, by any reasonably likely means.
Anonymisation changes data so that nobody can work out who it relates to, even by combining it with other information. Properly anonymised data is not personal data, so the DPDP Act does not apply to it.
Meaning of Anonymisation
Truly anonymised data is not about an identifiable person, so the Act does not apply to it. The bar is high. If a person can be re-identified by combining the data with other information, it is not anonymous.
The DPDP Act applies to digital personal data, which Section 2 defines as data about an individual who is identifiable by or in relation to such data. If a dataset has been altered so that no person can be identified from it by any reasonably likely means, it no longer fits that definition. The Act does not set out a technique or a certification for anonymisation, so the judgement rests on the facts.
The test is practical. Removing names and phone numbers is rarely enough, because other fields such as date of birth, PIN code, occupation and rare medical conditions can combine to point to one person. Researchers have repeatedly shown that supposedly anonymous datasets, such as film ratings or taxi trips, could be matched with outside information. A fiduciary should therefore ask who might hold the other pieces and how hard re-identification would be.
Common techniques include aggregation into totals and averages, generalisation into ranges, suppression of rare values, adding statistical noise, and sampling. Many are used together. Methods such as k-anonymity or differential privacy give measurable assurances, though they need expertise, and none removes the need to re-check risks as new data becomes public.
Anonymisation is not the same as pseudonymisation, where a key can restore the link, or as encryption, which can be reversed. The process of anonymising itself is processing of personal data and needs a lawful basis. Section 17(2)(b) also provides a separate exemption for research, archiving and statistical purposes, but it depends on conditions about decisions and prescribed standards, so anonymisation should not be assumed to meet them.
Examples of Anonymisation
A company publishes monthly total sales by city with no way to trace any entry to a person. That is anonymised.
A hospital group publishes monthly counts of dengue cases by district and age band. Cells with fewer than ten cases are merged, so no individual patient can be picked out from the table.
A ride-booking firm shares trip data with a city planner after removing rider IDs. An independent review shows that home and office pick-up points identify frequent riders, so the firm switches to zone-level aggregates.
A department studies exam results using anonymised marks grouped by course and year. It documents the techniques and the re-identification test, which helps it show that the research falls outside the Act.
Why Anonymisation matters
If data is truly anonymous, a business can use it for planning, benchmarking, publication and research without the consent, notice and rights obligations of the Act. This is valuable for hospitals, banks, retailers and public-interest researchers who learn from patterns, not from individual stories.
The risk lies in a failed claim. If data labelled as anonymous can be traced to people, a release is in fact a disclosure of personal data without a valid ground, and a leak may be a personal data breach attracting notification duties and penalties up to ₹200 crore for failing to notify, besides the exposure for security failures. Careful testing is the best defence.
How it works in practice
- 1Define the purpose first: what question the data needs to answer, and what level of detail is truly needed.
- 2Remove direct identifiers, then address indirect ones by generalising, grouping or suppressing values that are rare, and consider adding noise to numeric fields.
- 3Test re-identification risk by attempting to single out records, by linking to public datasets, and by checking small groups, using someone independent of the team that did the work.
- 4Control the release: limit who can access the dataset, add a contract term prohibiting re-identification, and avoid publishing raw records when aggregates will do.
- 5Re-assess regularly, particularly when new public data appears or when you combine the dataset with another, and treat the data as personal if anonymity cannot be shown.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Equating anonymisation with deleting the name column: other fields combined can still identify people.
Releasing a dataset once and never rechecking: new public data can make an older release traceable.
Keeping the original identifiable file and calling the copy anonymous without separating access: the organisation can easily link them, so the risk remains.
Forgetting that the act of anonymising uses personal data and needs a lawful basis and security during the process.
Compliance tips
Prefer aggregates over row-level data whenever the purpose allows.
Document the method and the test results so you can explain the decision to the Board if asked.
Consult a statistician or privacy engineer for high-risk datasets, such as health or location data.
Common questions about Anonymisation
Does the DPDP Act apply to anonymised data?
Not if the data is truly anonymised, because it is no longer about an identifiable individual. But if people can still be identified by reasonable means, it remains personal data.
How can I prove data is anonymous?
The Act sets no certificate. Keep a record of the techniques used, the re-identification tests and the controls on release. Independent testing strengthens your position, though each case depends on its facts.
Is removing names and phone numbers enough?
Usually not. Date of birth, PIN code, job and rare attributes can combine to single out a person. Anonymisation needs a review of all fields and of what other information is available.
Can I anonymise customer data without consent?
Anonymising is itself processing personal data, so you need a valid ground for it. Using it for a purpose covered by your notice and consent is the safest approach.