Should I Anonymise My NZ Business’ Data?

Summarise with: ChatGPT Perplexity Microsoft Copilot

---

Table of Contents

• What Is Anonymisation?
• How Does Anonymisation Improve Privacy?
• Should I Anonymise My Business’ Data?
• How Can I Anonymise My Business Data?
• Key Takeaways
• Frequently Asked Questions

When your business collects personal information from your customers, various privacy obligations and restrictions accompany that data. Under the Privacy Act, you need to take reasonable steps to protect and secure any personal information you hold, whether it be that of your:

• customers; 
• employees; or
• general members of the public.

Indeed, the reason you protect personal data against the possibility of a privacy breach is so that unauthorised people do not get access to it. As such, one of these protections is to anonymise or de-identify the personal data you hold. However, this may not be the appropriate protection measure in some cases or may not be available for certain kinds of information. Therefore, this article will explain when you should anonymise your New Zealand business’ data.

What Is Anonymisation?

Personal information is any data about an identifiable individual. Therefore, using this data, whether by itself or in combination with other data to identify a living person, qualifies as personal information.

Anonymisation refers to the process of removing all aspects of the data that can identify a person. Consequently, a third party cannot use a piece of anonymised data to backtrack and discover who the data is about.

For example, if you want to anonymise customer feedback forms, you would destroy all identifying aspects from the form. These can include their: 

• name;
• the location they shopped at; and 
• anything identifying in the feedback they provide.

Also, note the difference between data anonymisation and data de-identification. The table below sets out their differences.

How Does Anonymisation Improve Privacy?

When you remove any identifying data from personal information and prevent re-identification, third parties cannot use it to trace back to an identifiable individual. Consequently, if you lose this information in a data breach, there is less risk of individuals suffering serious harm from the said data breach. In addition, the lost data cannot identify them, so malicious actors cannot target them.

Under the Privacy Act, when you secure personal information, you need to do so in a way that is appropriate in the context. For example, more sensitive or high-risk information needs more intensive security measures. But, if you have already anonymised the information, you may not need to invest extensive time into alternate security measures, depending on your circumstances.

Should I Anonymise My Business’ Data?

Anonymising your data has numerous benefits, including:

• being an effective security measure to protect the personal information your business stores;
• helping you comply with your privacy law obligations;
• reducing the potential spread of harm from a data breach; and
• offering an alternative to disposing of personal data when you do not need it anymore.

When you anonymise personal data, it is no longer identifiable. Therefore, it does not come under legal rules for limiting the storage period of personal information. However, when you de-identify or anonymise instead of disposing personal data, you need to note this and detail how you are sufficiently preventing re-identification.

While the process has its benefits, true anonymisation can be difficult to achieve. Unsurprisingly, this is especially true now since parties can easily spread and dissect data online. Therefore, once you have anonymised your personal data, you cannot become complacent and assume your process is foolproof. Test your anonymisation, and update it as time goes on. 

In some cases, it may not be possible to anonymise. In these cases, you will need to identify other security measures or dispose of the personal data when you no longer need it.

How Can I Anonymise My Business Data?

Anonymising data involves removing all possible forms of re-identification from a piece of data. This process will depend on:

• the kind of data it is;
• how someone would use the data;
• how someone would search for the data; and
• the context in which someone would share the data.

The efficacy of your data anonymisation depends on the risk of identification. If this risk is minute, then you have likely successfully have anonymised your data.

The anonymisation process itself will involve:

• determining all possible identifiers;
• removing those identifiers through methods such as suppression, generalisation, or aggregation; 
• applying your removal technique; and
• evaluating your anonymisation efficacy.

For example, generalisation involves generalising specific identifying data, such as changing an exact birth date to a broader birth year. Different methods yield different results, so you need to look into what is appropriate for your situation. An IT consultant can help you with this process.

Key Takeaways

Data anonymisation refers to the process where you remove all possible ways a third party can identify who a piece of data is about. You need to confirm that the risk of identification is low enough to enjoy the benefits of anonymised data, such as increased security. If you would like more information, or help with your business’ data anonymisation, contact LegalVision’s data, privacy, and IT lawyers on 0800 005 570 or fill out the form on this page.

Frequently Asked Questions