Data anonymisation is the process of making information about people no longer identifying in its intended use and release context. For a quant researcher, the practical question is whether transaction data can support an analysis without exposing the customers behind it. Removing the name column does not answer that question: time, location and unusual trading patterns can carry identity too. The ICO's anonymisation guidance treats identifiability as contextual, including the information available to whoever receives the data.
The name disappears; the trail survives
Suppose a fictional broker replaces each customer's name with the same cryptographic hash on every row. It supplies the following four invented transactions for 14 September 2026. All times use the same local clock; hash codes are abbreviated for display.
| Hash code | Time | Channel / site | Instrument | Notional, AUD |
|---|---|---|---|---|
| 722c98 | 09:17 | North Terminal | Rare bond | 12,500 |
| 14439a | 09:20 | Central Office | Equity ETF | 1,000 |
| d6ca6d | 09:25 | Central Office | Equity ETF | 1,500 |
| 722c98 | 15:42 | Online | Equity ETF | 2,000 |
Now stipulate that a recipient independently knows that fictional customer A made the rare-bond transaction at North Terminal at 09:17. That combination matches one row in this table. The repeated code then links A to the 15:42 transaction as well. The recipient never reverses the hash.
This is a constructed linkage example, not a measured re-identification rate. Quasi-identifiers identify through association with other information. Here, the rare trade makes the time-and-site combination distinctive. NIST SP 800-188, §2.2 and §4.3 explains this distinction and the role of auxiliary data.
Original fictional linkage example. The daily aggregate preserves a chosen statistic; it does not establish anonymity.
A pseudonym is useful precisely because it links
Pseudonymisation replaces identifying information with a code while retaining a way to attribute the records using additional information. Keeping the identifying information separately and securely is part of the UK GDPR definition. That can let an authorised analyst study repeat behaviour without seeing names; it also explains why a stable code preserves a customer history. ICO: Pseudonymisation.
Calling the column a hash does not establish effective pseudonymisation or anonymisation. An unprotected hash of a small, guessable set of names may also be vulnerable to trying candidate inputs. Even strong protection of the name-to-code mapping would not remove the separate time-and-site linkage in the example. The ICO distinguishes the technique's label from whether its implementation meets the legal definition.
Deleting the mapping also leaves external linkage possible. NIST prefers de-identification to avoid implying irreversibility; terminology needs its jurisdiction and technical scope attached.
Change the output, then check what remains useful
If the research question is only “How much notional traded that day?”, the example can be reduced to 4 transactions totalling AUD 17,000, with no customer code or intraday path. This retains the daily count and total exactly. It cannot answer which customer traded twice, or whether an afternoon trade followed a morning trade.
That is the privacy–utility tradeoff in a form the researcher can test. Coarser timestamps can destroy event ordering; combining instrument categories can hide the rare trades that drive a strategy's capacity estimate; suppressing unusual observations can change the tail being studied. These are consequences to evaluate against the intended analysis, rather than assuming a transformed dataset preserves every research result.
Aggregation also needs a disclosure assessment. In this example, someone who already knows the other three notionals sum to AUD 4,500 can subtract them from AUD 17,000 and recover AUD 12,500. A total is not automatically harmless. Different releases must be assessed together, including overlapping groups and later information. The OAIC's de-identification guidance emphasises both the data and the access environment: a controlled research setting can preserve detail that would be unsuitable for unrestricted publication.
K-anonymity requires each designated quasi-identifier combination to occur in at least k records. Unrecognised linkage fields, shared sensitive attributes and combined releases remain problems. No universal k makes financial data legally anonymous. See NIST SP 800-188, pp. 17 and 47.
Put the conclusion in its legal and release context
Australia, checked 29 October 2026. Section 6 of the Privacy Act 1988 defines personal information around an identified or reasonably identifiable individual; de-identified information no longer meets that identification condition. The Federal Register lists compilation 104, dated 4 June 2026, as the latest version. Specific financial regimes can retain restrictions: section 20M restricts a credit reporting body's use or disclosure of de-identified credit reporting information. An anonymity assessment therefore does not establish unrestricted reuse rights. Privacy Act 1988, ss. 6 and 20M.
The OAIC's guidance, originally published in March 2018, assesses reasonable identifiability using recipients, available auxiliary information and practical means of identification. Its page currently flags updates concerning APP 11 following the 2024 amendments. UK: the ICO pages cited above likewise carry an under-review notice following the Data (Use and Access) Act. Their examples explain the distinction; they are not a universal release certificate.
A useful research record states the permitted analysis, recipients, retained detail, plausible linkage information and what would trigger reassessment. Permission to acquire or reuse data, discussed under alternative-data consent, remains a separate question. For the professional discipline of keeping client information within its documented purpose, Ethics and responsible data use has a public preview; the full lesson requires membership.
Sources
- ICO, How do we ensure anonymisation is effective? — UK identifiability, singling out, linkability and release context; under-review notice checked 29 October 2026.
- ICO, Pseudonymisation — UK GDPR definition, additional information and hashing risks; under-review notice checked 29 October 2026.
- OAIC, De-identification and the Privacy Act — Australian contextual assessment and utility/access tradeoffs; originally 21 March 2018, current update notice checked 29 October 2026.
- Privacy Act 1988, latest compilation — Australian law, compilation 104 dated 4 June 2026, ss. 6 and 20M; latest-version status checked 29 October 2026.
- Garfinkel et al., NIST SP 800-188 (September 2023) — US government statistical disclosure guidance, especially §2.2 and §4.3; technical guidance, not a financial-data legal safe harbour.