How to share a dataset without exposing personal data, in 5 steps
Why is it safe? Because everything is processed in your own browser: the file never leaves your computer.
Take stock: direct, indirect and sensitive identifiers
List every column and sort it. Direct identifiers point to a person on their own: name, ID number, email, phone number. Indirect ones identify only in combination: date of birth, gender, city, major. Sensitive data—health, religion, ethnicity, sexual orientation—does more harm if exposed.
Decide what to do with each column
Choose an outcome for each column. Delete is the safest: names, phone numbers and addresses. A personal identifier, such as an ID number, lets you follow each person through the analysis, for example when you link two files of the same people; replacing it with a random code lets you do that without revealing who the person is, and it is HILO’s main function. Generalize reduces detail: a date of birth becomes an age band. Leave as is is for what doesn’t identify anyone. If two columns run one per person, like ID number and student ID, one code is enough.
Check the free text
Comments and open answers can carry exactly what you deleted elsewhere: an ID number, a phone number, an email, a name. Look for them (long numbers, @ signs, names from the file) and cover them with a marker like [ID].
Measure the re-identification risk
Without names, a combination of indirect data can still be unique: Sweeney showed that ZIP code, gender and date of birth are enough to recognize a large part of the US population. Count how many people share each combination of age, gender, city and major (a pivot table does it). If some combinations identify only a few people, generalize those columns or leave them out.
Download, keep the code table apart and document
Download the file in the same format. The lookup table (original → code) lets you re-identify someone or reuse the codes in the next round, and it is as sensitive as the data: keep it somewhere safe and don’t share it.
Document which columns were deleted, coded or generalized, under which rules and what risk remained, without any data from the file: it serves an ethics committee or a methods appendix. Each country has its own data protection law and defines differently what counts as anonymized: check yours; this guide is not legal advice.
Other ways to do it
You can do it by hand in a spreadsheet (delete columns, replace values with VLOOKUP and count combinations with a pivot table), or with programs built for this, such as ARX or sdcMicro.
HILO is the better fit to do it without installing anything: it runs in the browser, the file never leaves your computer, it’s free, it needs no sign-up and it gives the same codes to several files. Another tool is the better fit if you need formal anonymization and risk-measurement methods, very large files or a reproducible script.
Remove the identifiers from your own file
Load an Excel or CSV file and decide column by column.
Reference
- Sweeney, L. (2000). Simple demographics often identify people uniquely (Data Privacy Working Paper 3). Carnegie Mellon University.
Updated
More guides
How to measure intercoder reliability
Cohen’s kappa in 5 steps: code separately, build the table, count the agreement, remove chance and report.
How to clean a survey dataset before analyzing it
Read the file correctly, find repeats, check columns, spot non-response codes and fix at the source, in 5 steps.
How to merge two survey datasets
Choose between stacking and joining by identifier, check that they measure the same thing, merge and review the result, in 5 steps.
How to code the open-ended responses of a survey
Read a sample, build the categories, assign each response, review and bring them into your dataset, in 5 steps.
How to operationalize a project’s objectives with your variables
Write the objectives, take stock of the variables, match them, define indicators and recognize what’s missing, in 5 steps.