How to de-identify company data for AI training
De-identifying company data means removing or replacing everything that points to a person, including names hidden in free text, while keeping relationships and reasoning intact. Good practice uses consistent stand-ins for each person, an independent specialist, human review of samples, deletion of raw copies and contracts that ban re-identification. Removing names alone is not enough.
What has to go: direct and indirect identifiers
Direct identifiers name a person on their own: names, email addresses, phone numbers, account numbers. Indirect identifiers only identify someone in combination, such as a job title, a city and a date. Latanya Sweeney's research found that about 87% of the US population was likely to be unique on just ZIP code, sex and date of birth.
Company messages are full of both, and of things no standard list covers. Tap a number in this made-up Slack message to see what a careful process would catch.
- Names and a customer's company: direct identifiers. Each person should become one consistent stand-in everywhere, not a blank.
- A dated event that someone could match to a calendar or a recording.
- An internal codename. Harmless-looking, but it can identify a client or a deal.
- This is the valuable part: a decision and its reason. A good process keeps it.
- A signature with a name, title and city. Signatures and quoted replies leak more than the message body.
The main techniques
| Technique | What it does | Watch for |
|---|---|---|
| Consistent replacement | Each person or company becomes the same stand-in everywhere, such as "employee 632" | The key must be held securely and separately |
| Suppression | Removes a detail entirely | Removing too much destroys the reasoning |
| Generalisation | Replaces a detail with a broader one: a city becomes a region | Combinations can still identify |
| Date shifting | Moves dates by a consistent amount, keeping the gaps between them | Public events can reveal the shift |
| Keyed hashing | Turns an ID into a code only the key holder can reverse | Unkeyed hashes of short IDs can be cracked |
Google's documentation for its de-identification tools describes the consistent kind of replacement: a method that "generates identical tokens for each instance of an identical input value", so who-said-what survives. The weak kind is easy to break: in 2014, hashed taxi licence numbers in a public New York dataset were reversed in minutes because the hashes had no secret key.
Why free text is the hard part
Detection software helps, but its makers are frank about the limits. Microsoft's open-source Presidio warns that it may not find all sensitive information, and recommends other protections alongside it.
Re-identification keeps getting easier. A 2026 study showed that AI can link pseudonymous writing to real people at scale, concluding that "the practical obscurity protecting pseudonymous users online no longer holds." In 2006, AOL replaced users' names with numbers in published search logs, and The New York Times still identified a user from her searches alone.
Why the job belongs with an independent specialist
- In-house clean-ups often delete the messy threads, which hold the decisions buyers value most.
- Ad hoc redaction replaces people inconsistently and breaks the relationships in the data.
- Your own staff know the context, so they miss what an outsider could use to identify someone.
- Standards bodies recommend independence: NIST suggests a review board for de-identification, and HIPAA's expert route needs a qualified expert's documented judgement.
The UK regulator's test is a useful one to borrow: could a "motivated intruder", someone who wishes to identify a person from the data, succeed with ordinary resources? Plan for buyers who will hold the data for years, and for tools that will keep improving.
What a good process looks like
- Decide what is in scope, and leave out client data, privileged advice, health records and anything about children.
- An independent specialist processes the raw export in a controlled environment.
- Each person and company becomes one consistent stand-in; dates shift consistently; signatures and quoted replies are handled.
- People review a sample by hand for anything the software missed.
- The raw copy is deleted after processing, and the method is written down.
- The licence bans the buyer from re-identifying the data or passing it on.
Under California's privacy law, the last two steps are part of what makes data count as de-identified. See is selling company data legal.
Questions
Is removing names enough to de-identify data?
No. Signatures, quoted replies, dates, job titles, codenames and customer names can all identify people, especially in combination.
What is the difference between anonymised and pseudonymised data?
Pseudonymised data replaces identifiers with stand-ins that can be reversed with a key, so privacy law usually still applies. Anonymised data can't reasonably be linked to anyone.
Why keep consistent pseudonyms?
So the same person stays the same stand-in across every system. Buyers value who-said-what-to-whom, and inconsistent replacement breaks it.
Can AI re-identify de-identified text?
Increasingly, yes. A 2026 study showed AI linking pseudonymous writing to real people at scale, which is why independent review and contracts banning re-identification matter.
Should we de-identify our data ourselves?
It's usually safer not to. In-house clean-ups tend to remove valuable reasoning, miss hidden identifiers and lack the independence a buyer or regulator will expect.
Sources
- NIST SP 800-188: De-Identifying Government Datasets (September 2023) US National Institute of Standards and Technology
- How do we ensure anonymisation is effective? UK Information Commissioner's Office
- Transformations reference, Sensitive Data Protection Google Cloud
- Presidio: data protection and de-identification SDK Microsoft (open source)
- Large-scale online deanonymization with LLMs (February 2026) Lermen et al., on arXiv
- Simple demographics often identify people uniquely (2000) Latanya Sweeney, Carnegie Mellon University
- AOL search log release (2006) Wikipedia
- Lessons from improperly anonymized taxi logs (June 2014) FlowingData
- 45 CFR 164.514, de-identification of protected health information Legal Information Institute, Cornell Law School