Re-Identification Risk Assessment

Assess whether your data can be considered anonymous and safe to use or share.

Independent, expert-led assessments to evaluate re-identification risk and support defensible anonymization decisions across regulatory frameworks.

When you need this

You want to use or share data for secondary purposes

You are working with data received from external sources (e.g. hospitals, research, insurers)

You are acting as a data processor and need to validate anonymization

You are unsure whether your dataset is truly anonymous or still personal data

Legal, compliance, or partners require a defensible assessment of risk

Many organizations do not have in-house expertise to perform this type of analysis and need an independent, objective evaluation.

What I do

I design or review anonymization frameworks that are practical, scalable, and aligned with your organization.

Dataset and context analysis

Dataset intake and
context analysis.

Identification and classification of data elements

Each attribute is reviewed and classified as:

  • non-identifier
  • direct identifier
  • indirect identifier


This step ensures that all elements are fully understood before any risk is assessed

Evaluation of transformations

If needed, identifying and assessing transformations to reduce risk and support anonymization.

Re-identification risk modelling

Using indirect identifiers to model the underlying population and assess the maximum re-identification risk.

This includes:

  • analysis of attribute combinations
  • consideration of external data sources
  • evaluation of realistic attack scenarios
Final assessment and recommendations

A clear conclusion on the level of re-identification risk and whether it meets the required threshold.

About anonymization thresholds

There are two approaches to anonymization:

Absolute anonymization:

no individual can be identified under any circumstances

Relative anonymization:

a very small and acceptable level of risk remains

What you get

The outcome is a clear, audit-ready report that enables you to:

  • Demonstrate that your dataset can be considered anonymous under applicable regulations
  • Support internal and external audits
  • Safely use or share data for the defined purposes
  • Understand and apply required transformations
  • Establish a repeatable approach for future datasets


The report is written to be:

  • technically robust
  • understandable for non-experts
  • reusable across similar use cases

Why this matters

Incorrect assumptions about anonymization can lead to:

  • regulatory risk
  • data misuse
  • blocked data projects


A structured and independent risk assessment ensures that decisions are defensible, transparent, and aligned with regulatory expectations.

Discuss your data set

And understand whether a re-identification risk assessment is needed. 

Request a consultation