Written down, versioned, and the same every time.

What it is built against

The identifier taxonomy follows the HIPAA Safe Harbor identifier classes at 45 CFR 164.514, used outside health precisely because it is specific and auditable. Lifecycle risk framing follows ISO/IEC 27559. Technique selection follows NIST SP 800-188. The residual-risk target follows a privacy regulator's published de-identification guidelines for structured data.

Technique by identifier class

• Direct identifiers. Names are replaced with a salted non-reversible token where the link between records has to survive, and otherwise suppressed. Contact details are suppressed. Account and government numbers are suppressed and never tokenised.
• Business information. Business names and addresses, and transaction, shift and report dates and amounts, are kept, and the technique recorded against them is "None required". Claiming to de-identify something that never identified a person would make every other statement here worth less.
• Quasi-identifiers. Dates tied to an individual, locations, rare roles and job titles. Generalised or banded. Dates are shifted only where a corpus needs it, with an offset generated per individual and stored with the salt, and the use is recorded.
• Free text. Either scanned for direct identifiers against the known identifier list for that delivery, or suppressed.
• Scanned and photographed documents. Identifiers removed by pixel destruction, not by an overlay. An overlay that can be moved is not a redaction.

Quality assurance

Two people. The operator who applied the standard and a second reviewer who did not. Both are recorded against the delivery, by name, in the provenance record. A corpus does not ship on one person's word.

Residual risk, stated per corpus

No de-identification reduces risk to zero, and a supplier claiming otherwise is telling you something untrue. Each corpus carries a residual-risk note describing what remains and why it was accepted. You get that note before you license, not after.

De-identified is not anonymised

These are different legal terms with different thresholds, and some privacy regimes distinguish them sharply. We say de-identified because that is what we do. Where a corpus meets a higher bar we say so specifically and show the working.

No re-identification

Every licence carries a covenant against attempting to re-identify any individual in a corpus, and against combining it with other data for that purpose. It binds the lab and anyone it sub-licenses to.