Anonymization
Anonymization is the irreversible transformation of data so that no individual can ever be re-identified — a higher bar than de-identification that takes the data outside privacy law.
Anonymization aims for a permanent, one-way result: even with additional data and reasonable effort, no one can be singled out. When data is genuinely anonymized, it is no longer *personal information* and privacy obligations fall away.
The key contrast with de-identification is reversibility. De-identified data can potentially be re-linked and stays regulated; anonymized data is meant to be *irreversible*. Quebec’s Law 25 sets a strict test: information is anonymized only when it is, *at all times, reasonably foreseeable in the circumstances* that it can no longer identify a person, using generally accepted best practices and criteria set by regulation.
Because that bar is high, true anonymization is harder than it looks. Techniques include aggregation, generalization, and adding statistical noise — always validated against realistic re-identification attacks before you rely on it.
