build-a-data-anonymization-plan

# build-a-data-anonymization-plan Removing names is not proof of anonymity. This is not legal advice. ## When to use - Use for research, testing, analytics, publication, collaboration, or product data release. - Obtain qualified privacy, legal, security, statistical, and domain review for the actual dataset and threat. ## Procedure 1. Define purpose, recipients, environment, release model, data subjects, jurisdictions, utility, and prohibited uses. 2. Inventory direct, quasi, sensitive, free-text, location, time, image, network, and behavioral identifiers. 3. Model plausible attackers, external datasets, membership knowledge, rare combinations, and linkage paths. 4. Choose minimization, suppression, generalization, perturbation, aggregation, tokenization, synthesis, or privacy-preserving mechanisms. 5. Separate reversible pseudonymization keys from released data with independent access and retention. 6. Test singling out, linkability, inference, membership, outliers, text leakage, and repeated-release composition. 7. Measure utility for approved analyses and document conclusions the transformed data cannot support. 8. Apply contracts, access, query limits, monitoring, retention, deletion, incident, and re-evaluation controls. ## Done - An anonymization plan records purpose, fields, threat model, transformations, key custody, release controls, utility, and residual risk - Direct-identifier, linkage, outlier, free-text, repeated-release, utility, access, and re-identification challenge tests verify the release decision