Anonymisation for tabular data

Direct identifiers are rarely required for secondary analysis and should normally be removed prior to sharing.

Common direct identifiers in tabular data include:

• name
• telephone number
• email address
• physical address
• phone number
• IP address
• unique personal identifiers (e.g. NHS number, National Insurance number).

Direct identifiers should only be retained where there is a clear legal and ethical justification. If direct identifiers are retained and individuals remain identifiable, the dataset should not be treated as anonymised.

Socio-demographic variables are often critical for research analysis. In tabular data these may include:

• age
• ethnicity
• national identity
• religion
• education level
• employment details
• household size and composition
• income and financial information.

Retaining these variables, even in modified or aggregated form, is often essential to ensure data remain analytically meaningful. The aim is therefore not removal, but proportionate reduction of precision.

Indirect identifiers may not identify an individual on their own, but can enable identification when combined. These are particularly relevant in structured data where combinations of characteristics may be unique.

Anonymisation methods for quantitative data are often classified into:

• Non-perturbative techniques (which modify structure or precision without altering values at random).
• Perturbative techniques (which deliberately modify original values).

Banding (binning)

Banding is particularly useful for continuous variables such as age and income. By grouping values into broader ranges, uniqueness is reduced while preserving analytical patterns.

Example:

Banding reduces disclosure risk while maintaining income distribution analysis.

Generalisation

Generalisation reduces the specificity of detailed variables. It is particularly important where data include free-text responses.

For example, a response such as:

“I moved abroad, to Paris, for many years. I lived on Rue de Rivoli near the Louvre…”

May be generalised to:

“Not eligible due to years spent living abroad without contributions.”

Generalisation should preserve analytical meaning while removing unnecessary identifying detail.

Recoding (category reduction)

Recoding reduces the number of unique categories within a variable by collapsing detailed codes into broader groups.

This is particularly useful for variables such as:

• educational attainment
• ethnicity
• occupation.

For example, detailed qualification categories may be recoded into broader levels aligned with national standards used by the Office for National Statistics during the 2021 Census:

0 No qualifications
1 Level 1 and entry level qualifications
2 Level 2 qualifications
3 Apprenticeship
4 Level 3 qualifications
5 Level 4 qualifications or above
6 Other

Top and bottom coding

Extreme values at the tails of a distribution may be rare and therefore identifying.

For example, original ages:

27, 118, 89, 56, 48, 31, 5

May be top/bottom coded as:

• 18 or younger
• 80 or older.

Managing small cell counts

In frequency tables or cross-tabulations, small cell counts can create disclosure risk. Suppression, aggregation or cell merging may be necessary where combinations of variables produce very small groups.

In microdata, disclosure risk often arises when individuals are unique or nearly unique based on combinations of quasi-identifiers (for example, age × occupation × geography).

One formal approach to reducing this risk is k-anonymity, which aims to ensure that each record is indistinguishable from at least k–1 other records with respect to selected identifying variables. In practical terms, this means that no individual can be singled out based on the combination of quasi-identifiers included in the dataset.

However, k-anonymity and related privacy models should be applied carefully. They do not automatically eliminate all disclosure risks, and they can reduce data usability considerably. k-anonymity and related privacy models are particularly relevant where data are intended for release under open reuse licences. In such cases, anonymisation must be effective without relying on any other restrictions.

Perturbative methods introduce controlled changes to values in order to reduce identification risk while preserving overall statistical properties.

Examples include:

• Noise addition: adding small random variation to continuous variables.
• Data swapping: exchanging selected values between records to reduce linkage risk.

Because perturbative methods alter original data values, they should be applied cautiously and transparently to avoid distorting analytical conclusions.

The QAMyData tool provides a health check for numerical data including detection of direct identifiers and outliers on user set thresholds.

There are also a number of statistical disclosure control tools for tabular data including the R package sdcMicro, which offers a friendly graphical user interface, μ-ARGUS developed by Statistics Netherlands for applying statistical disclosure control methods to microdata and ARX, a versatile open-source data anonymisation tool that supports a range of anonymisation techniques for structured data, including k-anonymity and l-diversity.

When using any tools for anonymising or processing tabular data it is crucial to ensure that they are deployed locally and not reliant on external servers or unrestricted cloud services, which could inadvertently expose sensitive data to third parties. Data producers must take responsibility to verify that any software used for data processing is configured correctly to prevent data from being uploaded to unknown or insecure entities.