Research Data Anonymization: 10 Mistakes Researchers Make in Dissertations
Table of Contents
Research data anonymization sounds simple until you open your own spreadsheet and find a participant’s name sitting in a hidden column. After 12 years of guiding dissertations, I believe confidentiality is where good intentions most often outrun technique. Most researchers are not careless; nobody ever explained what “anonymize the data” actually means.
This guide lists 10 mistakes, shows safer ways to prepare your data, and is honest about where anonymization stops working. The legal points link to primary ICO and HHS guidance, so you can verify them yourself.
The costliest research data anonymization mistakes are treating pseudonymization as anonymization, leaving indirect identifiers in the data, and sharing unprotected files, so fix those three first.
The 10 mistakes at a glance
- Confusing pseudonymization with true anonymization
- Leaving identifiers in spreadsheets
- Missing indirect identifiers
- Ignoring small samples
- Relying on find-and-replace for transcripts
- Storing the key file next to the data
- Sharing unprotected files
- Anonymizing too late
- Reusing quotes and appendices unchecked
- Promising complete anonymity
The case studies below are composites with details changed, so no real participant can be identified.
What Is Research Data Anonymization?
Research data anonymization is the process of removing or changing identifying details in a dataset so that no participant can be identified, either directly or by combining it with other information. Done properly, it cannot be reversed, not even by the researcher.
UK sources spell it anonymisation, but the meaning is the same. Direct identifiers point to a person on their own, such as a name, email, phone number, student ID, photo or voice. Indirect identifiers look harmless alone but combine to point to one person, such as age, job title, postcode, employer, course year or a rare life event.
Extra care applies to special category data under UK GDPR, such as health, ethnicity, religion and sexual orientation, and good research data anonymization handles direct and indirect identifiers together.
Why is the HIPAA identifier list not enough?
HIPAA Safe Harbor lists 18 identifiers to remove, while Expert Determination lets a qualified expert certify that the risk is very small. I treat the list as a starting point, not an endpoint. HHS guidance says data still fails Safe Harbor if you actually know that a unique characteristic, such as a rare job title, remains in it. HIPAA also covers only health entities, so most student projects follow university IRB policy (based on the Common Rule where it applies) and FERPA for education records.
Anonymization vs Pseudonymization in Research
Pseudonymization replaces names with codes such as P01 while you keep a key linking the codes to real people, whereas anonymization has no key and cannot be reversed.
Under UK and EU GDPR, truly anonymous data falls outside data protection law, while pseudonymized data stays personal data, as the ICO’s 2025 anonymisation guidance confirms. Its “motivated intruder” test asks whether a determined, competent person using public resources could identify someone. I like the test, although it was written for organizations with data protection teams, not students with laptops. My student version is simple: if a few searches can pick out a participant, the data is not anonymous.
| Feature | Anonymization | Pseudonymization |
|---|---|---|
| Can it be reversed? | No | Yes, with the key |
| Personal data under UK GDPR? | No, if truly anonymous | Yes |
| Typical use | Data sharing, repository deposit | Follow-up studies, member checking |
| Main risk | Re-identification through indirect identifiers | Leaked key file |
A project that keeps a key file has done pseudonymization rather than research data anonymization, and that is perfectly acceptable as long as you say so.
10 Mistakes in Research Data Anonymization
These are the ten problems I would check first in any dissertation dataset.
1. Confusing pseudonymization with true anonymization
Replacing “Priya Sharma” with “P07” is pseudonymization, so while you hold a key, true research data anonymization has not happened. Tell participants their data is “confidential and pseudonymized”, not “fully anonymous”.
2. Leaving identifiers in spreadsheets
Names hide in extra sheets, hidden columns, cell comments, file names and document properties, and survey exports often add IP address, location and timestamps. In Excel, run Info, Check for Issues, Inspect Workbook before sharing, and if you are unsure which columns travel with each row, revisit how tabular data is structured.
3. Missing indirect identifiers
Sweeney’s study of 1990 US census data found that ZIP code, gender and full birth date could single out 87 per cent of people. Golle’s re-analysis of the 2000 census gave 63 per cent. HHS guidance adds that being unique is not the same as being identified, because an intruder also needs a naming source such as a voter list. I think that debate misses the point for dissertations, since your “population” is 12 or 40 people and far fewer details are needed to identify someone.
4. Ignoring small samples
Composite case: A student interviewed 12 school principals in one district and wrote “a female principal aged 50 to 55”, but only one person fitted, and her colleagues would know at once. The fix was “a school leader” plus patterns across the group. Borrow a k-anonymity test: every combination of indirect identifiers should be shared by several participants.
5. Relying on find-and-replace for transcripts
Swapping “Meera” for “Participant 3” ignores “my cousin who runs the bakery opposite the town hall”, and nicknames, workplaces, landmarks and speaker labels leak in the same way. Research data anonymization of interview transcripts needs a careful human read, explained below.
6. Storing the key file next to the data
In research data anonymization the key file is the weakest link. Keep it in separate, encrypted storage, never in the same folder, drive or email thread as the data. Decide who may open it and when it will be deleted, and record this in your data management plan. Keeping your dissertation files organized makes that separation easier.
7. Sharing unprotected files
Raw spreadsheets travel by email, WhatsApp and “anyone with the link” folders, so share only the anonymized copy through approved encrypted storage and send passwords separately. Transcription services and AI tools process your data, so check your ethics approval and their data terms first, and see checking AI-assisted dissertation analysis before relying on one. Do not assume university IT security covers this either, because it protects storage, not your decisions about what stays in the data.
8. Anonymizing too late
Research data anonymization works best when planned before data collection, and for primary data these decisions are yours from day one, as covered in handling primary participant data. Keep a locked original, work on a copy and save your recoding steps. Practise data minimization too, and skip date of birth if an age band will do.
9. Reusing quotes and appendices unchecked
Composite case: A thesis entered a university repository with a distinctive quote in chapter four, and pasting that quote into Google led straight to the participant’s public blog. Quotes are searchable, appendices get published, and table cells with counts of one or two can expose people. Paraphrase lightly or suppress small cells.
10. Promising complete anonymity
No method of research data anonymization gives zero risk, and HHS itself says both HIPAA methods leave a very small risk that is not zero. A fairer consent line is: “I will remove names and take reasonable steps to prevent identification, but in a small group complete anonymity cannot be guaranteed.” In my view, ethics boards value honesty over big promises.
How to Anonymize Research Data: A Step-by-Step Method
This is the research data anonymization workflow I recommend.
- Collect only what you need. Data minimization is the cheapest protection.
- Lock the original. Store it in encrypted, approved storage and work on a copy.
- List every identifier. Mark direct and indirect identifiers in each variable and interview question.
- Remove or generalize. Delete direct identifiers, then turn exact age into bands, postcodes or ZIP codes into regions, and exact dates into years.
- Scrub hidden content. Check file names, comments, tracked changes, document properties and survey export fields.
- Test and document. Run your student-sized intruder check, then record every decision in your data management plan and methodology chapter.
Practical tips for SPSS and Stata
- SPSS: use Recode into Different Variables for age bands, then remove the original with
DELETE VARIABLES. - Stata: run
duplicates report age_band region sector. A combination with one copy is unique and needs generalizing.
Five-point research data anonymization check before you share any file
- No hidden sheets, comments or properties remain.
- Every combination of indirect identifiers is shared by several participants.
- The key file is stored separately and encrypted.
- The file travels only through approved, access-controlled storage.
- Your consent form covers this kind of sharing.
Removing Personal Identifiers from Datasets: A Spreadsheet Example
Here is how one row changes during research data anonymization.
| Field | Before | After |
|---|---|---|
| Name | Anita Rao | P12 |
| Age | 34 | 30 to 39 |
| Employer | St. Mary’s Hospital | Healthcare sector |
| ZIP code | 60614 | Midwest region |
| Joined | 12/03/2023 | 2023 |
The after-row still supports analysis by age group, sector and region, and a UK postcode such as M14 5RT becomes a region in the same way. If only three healthcare workers took part, even “healthcare sector” may be too specific.
Anonymizing Qualitative Interview Transcripts: A Before and After Example
To anonymize an interview transcript, replace every name, place, employer and rare detail with a neutral descriptor, and keep a log of each replacement.
Original: “I told Mr Mehta at the Leeds branch that after my mother passed in March, I could not keep up with the loan.”
Anonymized: “I told [branch manager] at [a high street bank] that after [a family bereavement], I could not keep up with the [loan] payments.”
In transcripts, research data anonymization means swapping details for descriptions, because a page of [REDACTED] is useless for thematic analysis. The UK Data Service advises planning anonymization at transcription and avoiding over-anonymizing, and I agree.
What about audio and video recordings?
Cleaning a transcript does not clean the recording, because voices and faces are identifiers. Keep recordings in restricted storage and delete them once transcripts are verified, if your approval allows. If you must keep them, get explicit consent and treat the files as identifiable data.
Protecting Participant Confidentiality in Research: The Limits of Anonymization
Can anonymized data be re-identified?
Yes. It happens when indirect identifiers remain, when the data links to another dataset, or when a sample is so small that participants recognize each other. Pinsent Masons’ summary of the ICO guidance notes that generative AI tools now count among a motivated intruder’s sources, which makes matching a quote to a person easier.
How much research data anonymization is too much?
More generalization lowers risk but also reduces detail. The UK Data Service notes that controlling access can beat over-anonymizing, so sensitive data may suit a restricted-access tier at a repository such as the UK Data Service or ICPSR. Research data anonymization lowers risk but never removes it.
What should a consent form promise?
Promise only what you can deliver, and ask separately for consent to share anonymized transcripts and to use quotes. Where risk is high, ask whether a data protection impact assessment (DPIA) is needed, since the ICO guidance covers DPIAs under accountability and governance. Your university is usually the data controller, so its policy beats any general advice, including mine.
When to Get Expert Help with Research Data Anonymization
Ask for help with research data anonymization if your topic is sensitive, your population is small, you hold special category data, or you plan to deposit data in a repository. A second pair of experienced eyes, working in SPSS, Stata, R or Excel, catches what you have stopped seeing. If you are unsure, read how to know if you need a dissertation expert.
If budget is tight, the five-point check above and the free checklist cover most of the risk before you pay anyone.
For help reviewing the identifiers, spreadsheet fields or transcript excerpts in your research data, contact Statssy.
Frequently Asked Questions
Is pseudonymized data still personal data?
Yes, under UK and EU GDPR, because a key can link the codes back to real people, so the data stays within data protection law.
Do I have to anonymize my dissertation data?
You must at least protect participant identities in anything you report or share, though the rule depends on your consent form, ethics approval and institution. Research data anonymization is expected for anything shared or published.
What are the 18 HIPAA identifiers?
Personal details (4): names, geographic areas smaller than a state, dates other than year, full-face photos
Contact (3): phone numbers, fax numbers, email addresses
Record numbers (5): Social Security, medical record, health plan, account, certificate or licence numbers
Technical (4): vehicle identifiers, device identifiers, web URLs, IP addresses
Biometric identifiers (1)
Any other unique code or characteristic (1)
They apply to HIPAA-covered health data, so most student projects follow their IRB instead.
What is an example of an indirect identifier?
A job title, small-town postcode or ZIP code, employer, age or rare event. Alone each may be harmless, but “the only nurse manager aged 40 to 45 in a named town” is one person.
Is it safe to upload interview transcripts to AI tools?
Only if research data anonymization has already been done on the transcripts, your ethics approval allows it, and you have read the tool’s data policy. Never upload raw recordings or transcripts containing names.
How long should I keep the key file?
Keep it for the period stated in your ethics approval and data management plan, then delete it, or destroy it sooner if you never need to re-contact participants.
How do you protect participant confidentiality in research?
Collect only what you need, anonymize or pseudonymize early, store data encrypted, share only through approved channels, and be honest in your consent form about what you cannot guarantee.
How do I protect participant confidentiality in a small sample?
Generalize details, report patterns instead of individual profiles, avoid cross-tabulating several demographics, and get consent for each quote.
Final Word: Make Research Data Anonymization a Habit
Research data anonymization is not a one-click job but a series of small, careful decisions made early and written down.
About the author: Siddharth Gupta is an independent data consultant who has worked since 2018 across marketing, finance, HR and operations analytics. He holds an MBA (Finance), a BE in Electronics and Communication Engineering and the Google Data Analytics Certificate, works in R, SPSS, Stata and Excel, and has guided dissertation and research writing for 12 years. LinkedIn