De-Identification and Pseudonymisation of Client Data

De-Identification vs Pseudonymisation

De-identification is an outcome assessed in context. Pseudonymisation replaces an identifier with a substitute, such as changing a client’s name to “Person A”. That substitution can help protect identity while preserving connections between documents.

Under Australia’s Privacy Act 1988 (Cth), personal information includes information or an opinion about an identified or reasonably identifiable individual. The Office of the Australian Information Commissioner (OAIC) explains that effective de-identification under the Privacy Act requires a very low re-identification risk in the relevant environment. Removing direct identifiers is the first part of that assessment.

A pseudonym does not establish that outcome. If someone can connect “Person A” with the client through a retained lookup table or the document’s details, assess that ability to identify them. Keep the lookup table separate from the working copy and restrict access. Treat information as personal information where the person remains reasonably identifiable.

For example, a hypothetical file can label accounts “Account A” and “Account B” to preserve a transfer relationship. Including the client’s real name in the file name defeats that substitution before anyone reads the transactions.

Anonymisation and Data Masking

Anonymisation is a process intended to prevent identification from the data, including when it is combined with other information. The Asia Pacific Privacy Authorities’ anonymisation guide explains that terminology and legal thresholds differ between jurisdictions. In Australia, apply the Privacy Act’s de-identification test instead of assuming an “anonymous” label settles the question.

Data masking obscures or replaces selected values. Masking techniques include hiding account-number digits or substituting codes for names. Masking describes what happens to a field. De-identification asks whether a person is still reasonably identifiable from the information and its context.

Consider this hypothetical statement example:

The final row uses fictional data. It does not demonstrate that an edited version of the real statement has passed a de-identification assessment.

How to De-Identify Client Documents

Prepare a separate copy that contains only the information needed for the intended task. Keep the source documents intact in the matter file.

Before editing, identify the proposed recipient or AI service and the purpose of the work. Record your firm’s authorisation for that use. The OAIC’s guidance on commercially available AI products recommends against entering personal information into publicly available AI chatbots as best practice. A changed name alone does not resolve that concern.

1. Define what the task needs. A question about wording may need one paragraph, while a transaction reconciliation may require exact amounts. Exclude unrelated pages and attachments.
2. Remove direct identifiers throughout the copy. Check names, signatures, addresses, email addresses and telephone numbers. Include account numbers, payment references and identifiers of counterparties, not only the client.
3. Use consistent substitutes where relationships matter. Label the same person or account consistently across statements and correspondence. Store any mapping separately, with restricted access.
4. Review indirect identifiers. Look for employers, unusual job titles, small locations, distinctive purchases and descriptions of rare events. Generalise or remove details the task does not need. If exact details must remain, reassess whether the copy can meet the intended privacy standard.
5. Remove recoverable and hidden information. Apply permanent redaction to the working copy where needed. The PDF redaction tool addresses that document-editing task. Check selectable text, comments and attachments as well as the visible page. Review file properties with the PDF metadata remover, and remove identifying file names.
6. Review the exported copy in its intended context. Reopen it and search for the original names and account numbers. Ask a second authorised reviewer to examine whether the remaining facts identify anyone. Record the outcome and any access restrictions before sharing.

A successful text search check means those searched identifiers are absent from the searchable content. It does not establish that the whole document is de-identified. Inspect images and remaining narrative details too.

Re-Identification Risk

Re-identification occurs when remaining details allow someone to connect a record to a person. The Information and Privacy Commission NSW’s de-identification guidance describes the risk from combining information, rare characteristics and coded records that can be linked back to identifying details.

In a hypothetical matter, correspondence identifies a sole practitioner’s unusual occupation and a small town. A statement shows payments from the same named business. Removing the client’s name from each document leaves a possible connection when the recipient reads both together.

Assess the whole bundle, including the prompt and earlier material available to the recipient. Restricted access can reduce risk, but it needs to match the actual environment. An internal copy and a publicly shared copy require separate assessments.

If a name reappears in extracted text, return to the working copy and correct the redaction. If the narrative still identifies the client, reduce the detail or use a fictional example. Where removing necessary facts would make the task unreliable, use an authorised environment for personal information instead of describing the copy as anonymous.

Record who receives the copy and why the remaining identification risk is acceptable for that context. Reassess before changing recipients or adding documents. If a person remains reasonably identifiable, handle the copy as personal information.