How to Anonymize Data Before You License Company Records
Here is how to anonymize data before company records leave your hands. What gets removed, the methods specialists use, and the difference between data that's truly anonymous and data that only looks it.
New to this? Start with the main guide on how to selling data to AI buyers, then use this page for the detail.
Before company records reach AI developers, identifying details are removed: names, emails, phone numbers, addresses, account numbers and anything else that points to a person. Specialists use automated detection plus human review, replacing details with placeholders. The goal is data that can't reasonably be linked back to a person, which is a higher bar than swapping names for codes.
Why it matters how you anonymize data
| Category | Examples |
|---|---|
| Names | People, and often company names of customers and vendors |
| Contact details | Emails, phone numbers, addresses, social handles |
| Account numbers | Bank, card, customer, invoice and contract numbers |
| Online identifiers | IP addresses, URLs that identify a person, user IDs |
| Dates and places tied to a person | Birthdays, home locations, exact dates in sensitive contexts |
| Media | Faces in photos, voices in recordings where required |
| Sensitive content | Health, HR, legal and financial details about individuals |
How it's done
- Automated detection. Models flag names, emails, numbers and other identifiers across every message and file.
- Replacement. Identifiers become consistent placeholders, like [PERSON_14], so conversations still make sense.
- Generalization. Exact values become ranges or categories where precision isn't needed.
- Suppression. Whole messages or files are dropped when they can't be cleaned safely.
- Human review. People check samples for what automation missed.
- Documentation. The method and results are written down so the standard can be shown later.
Anonymous vs pseudonymous
Swapping names for codes is pseudonymization. Under GDPR Recital 26, pseudonymized data that can be linked back to a person with extra information is still personal data. Truly anonymous data, where a person can't be identified by any means reasonably likely to be used, falls outside the GDPR. Good anonymization aims for the second, and doesn't keep a lookup key alongside the data.
Borrowed standards
There's no single legal standard for anonymizing business records. Many specialists borrow from health privacy, where HIPAA allows two routes: Safe Harbor, which removes 18 listed identifier types, and Expert Determination, where a qualified expert finds re-identification risk very small. They're useful benchmarks even outside health care.
What to ask a buyer
- Who does the anonymization: the buyer, a specialist firm or you?
- Does it happen before any lab or third party sees the data?
- What standard and methods do they use?
- Can you review an anonymized sample?
- What happens to content that can't be cleaned?
This guide is general information, not legal or tax advice. Talk to your attorney and CPA before you sign anything.
Next in this series: data licensing agreement.
Common questions
Is anonymized company data really anonymous?
It can be, but context can sometimes still point to a person. That's why specialists combine automated detection, human review and suppression.
Who anonymizes data in a licensing deal?
Usually a specialist privacy firm hired by the buyer, before anything goes to AI developers.
Do I need to anonymize my data before selling it?
Usually not. With direct buyers, anonymization is part of the deal. Confirm who does it in the contract.
Does anonymization lower the value?
A little detail is lost, but buyers want the patterns of work, not who said what.
- GDPR Recital 26: Not applicable to anonymous data. https://gdpr-text.com/en/read/recital-26/
- Accountable: HIPAA Safe Harbor vs Expert Determination. https://www.accountablehq.com/post/what-counts-as-de-identified-information-under-hipaa-safe-harbor-vs-expert-determination
- Fast Company: Shuttered startups are selling old Slack chats and emails to AI companies. https://fastcompany.com/91528808/shuttered-startups-are-selling-old-slack-chats-and-emails-to-ai-companies