Anonymisation

Anonymisation means rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even when matched with other data. Anonymous data is no longer personal data and falls outside the KVKK. Article 7 of the KVKK provides anonymisation as a method of disposal alongside erasure and destruction of data whose processing grounds have ceased.

Anonymisation Methods

The Personal Data Protection Authority’s guidance on erasure, destruction and anonymisation lists various methods:

• Methods that do not distort values: Removing variables, removing records, regional suppression and top or bottom coding.
• Methods that distort values: Micro-aggregation, data swapping and adding noise.
• Statistical methods: Techniques such as aggregation and k-anonymity that make each record indistinguishable from a certain number of others.

Re-identification Risk

Whether a dataset is anonymous is assessed not only by looking at that dataset but also considering the possibility of combining it with other sources. The average salary of a small department or a regional statistic on a rare disease may reveal individuals even without names. Anonymisation should be treated as a process in which this risk is regularly reassessed.

Difference from Pseudonymisation

Pseudonymisation, where names are replaced with codes and individuals can be re-identified with a key, is not anonymisation; pseudonymised data remains personal data.