k-anonymity

k-anonymity is a formal privacy model, introduced by Latanya Sweeney in 2002, under which a dataset is said to be k-anonymous if every combination of quasi-identifier values (attributes such as age, sex, postcode or diagnosis date that could be linked to external sources) is shared by at least k records. Any individual is therefore indistinguishable from at least k-1 others, which reduces the risk of re-identification by linkage. It is achieved through generalisation (replacing exact ages with bands, postcodes with regions) and suppression (removing outlier records).

k-anonymity addresses the "singling out" risk identified in the Article 29 Working Party Opinion 05/2014 on anonymisation techniques, but not the risks of inference: if all k records in a group share the same sensitive value (for example the same diagnosis), the attribute is disclosed. Refinements such as l-diversity (requiring diverse sensitive values within each group) and t-closeness (requiring the distribution of sensitive values in each group to be close to the overall distribution) were developed to close these gaps, and differential privacy offers a fundamentally different, probabilistic guarantee.

In health research, k-anonymity is widely used when releasing datasets for secondary use, preparing clinical study reports for EMA Policy 0070 publication, or sharing trial data through platforms. A k of 5 to 11 is common in practice, but the appropriate value depends on context. Applying k-anonymity is itself a processing operation on personal data, and the resulting dataset should be assessed and documented as anonymous or pseudonymised before it is treated as outside the GDPR.