Pick the technique by the data and the purpose
Every de-identification job comes down to two questions. What kind of data is this? And what does the person receiving it need to do with it? A support log, a salary report and a research dataset each need a different answer.
The techniques
Google's Sensitive Data Protection documentation lists the standard set. Here is what each one does.
Redaction removes the value completely.
Replacement swaps the value for one you choose.
Replace with type swaps the value for its kind, so "maria@example.com" becomes "EMAIL_ADDRESS". The reader knows an email was there without seeing it.
Masking covers all or part of a value with a character, like showing only the last four digits of a card.
Cryptographic hash replaces a value with a fixed code made with a key. The same input gives the same code.
Format-preserving token replaces a value with a token of the same length and characters, so a nine-digit ID stays nine digits. It can be reversed with the key.
Deterministic token replaces a value with a token, where identical inputs always give identical tokens. It can be reversed with the key.
Bucketing replaces exact numbers with ranges, so a salary becomes "100,000 to 150,000". This protects people who would otherwise stand out, like the only director in a department.
Date shifting moves dates by a random number of days, and can keep the shift consistent for the same person, so the gaps between their dates stay true.
Time extraction keeps only part of a date, such as the year.
Text inside images, such as scans and screenshots, is found with optical character recognition and covered.
The step most tools skip
Every technique above works on values. None of them knows that "Maria Delgado", "M. Delgado" and "Mria" are the same person.
A deterministic token gives "Maria Delgado" one token and "M. Delgado" a different one. Now one person looks like two, your counts are wrong, and the version the detector missed walks out in plain text.
So the real first step is linking: find every version of each person across every file, tie them together, then apply the technique.
One caution for health data
Under HIPAA's rule, 45 CFR 164.514(c), a code that lets you re-identify records must not be derived from information about the person. A hash generated from the name is derived from the name. For HIPAA data, use random IDs kept in a locked table.
Where we come in
We run the full process inside your walls: find every sensitive value in documents, scans, emails, transcripts and spreadsheets, link every version of each person, apply the right technique for your purpose, and report on every batch. Book a review and bring a sample.
