What is Re-identification Risk Assessment?
A re-identification risk assessment evaluates how likely it is that anonymised or pseudonymised data can be linked back to real people. It helps organisations identify, reduce and document privacy risks before collecting, storing or sharing survey data.
Re-identification is the process of matching de-identified data (for example, survey answers with names removed) back to the individuals who provided it. A re-identification risk assessment systematically reviews the data you plan to collect or release, the context in which it will be stored or shared, and the external information an attacker could combine with it. The assessment looks for direct identifiers (names, email, ID numbers), indirect identifiers or quasi-identifiers (age, postcode, home language, household size) and high-risk free-text responses where people might mention personal details. It evaluates factors such as sample size, uniqueness of records, the presence of small groups or rare characteristics, and how translations or formatting might make people identifiable. The goal is to choose practical treatments—data minimisation, aggregation, suppression, pseudonymisation, access controls or differential-privacy techniques—and to document the residual risk and governance decisions.
Usage example
Before publishing school survey results that include students' home languages and neighbourhoods, the data officer runs a re-identification risk assessment. The review finds that combining postcode, age and a rare language could single out a family in a small village, so they aggregate postcode to a larger area and remove precise ages before release.
Practical application
Why this matters: re-identification can harm participants and damage trust, and can lead to legal or regulatory breaches (for example under data-protection laws). Practically, an assessment helps you design surveys that collect only what you need, choose safe ways to translate and store responses, and decide how to share results responsibly. For Hearo users this means: avoid asking unnecessary identifiers in forms, treat free-text answers as potentially sensitive (especially in small-language communities), use aggregation or suppression before publishing, restrict who can see raw responses, and keep a record of your assessment and mitigation steps so you can justify decisions to stakeholders or regulators.
FAQ
When should I run a re-identification risk assessment?
Run one before you collect data and before you publish or share any dataset derived from respondents. Repeat the review if you change question content, add demographic fields, combine datasets, or plan to release data publicly.
How can I reduce re-identification risk in a multilingual survey?
Limit collection of direct identifiers, avoid overly specific demographic fields for small communities, aggregate geographic details, treat free-text responses as sensitive (review and redact if needed), and apply consistent access controls. Also consider how automatic translation preserves or alters identifying details and provide a way for participants to flag sensitive content.
Can data ever be perfectly anonymised?
Perfect anonymisation is very hard to guarantee, especially with rich or linked datasets. The goal of an assessment is to reduce risk to an acceptably low level and document residual risk. Use a combination of techniques (minimisation, aggregation, pseudonymisation, access restrictions) and seek advice from a data-protection officer or privacy expert for high-risk projects.
Do legal or ethical rules require a formal assessment?
Requirements vary by jurisdiction and context. Many privacy frameworks and funders expect documented risk assessments for projects involving personal data, and some laws (like GDPR) require Data Protection Impact Assessments for high-risk processing. Treat a re-identification risk assessment as part of good ethical practice and consult legal or compliance teams when in doubt.