Anonymising Data using k-Anonymity

Data anonymisation is an important approach in data governance and management; it enables organisations to protect personal information while sharing, processing, and making use of such information. However, anonymisation still carries the risk of re-identification. A well-known approach which allows organisations to quantify the risk of re-identification utilises k-anonymity.

This hands-on, interactive course provides an in-depth exploration of k-anonymity. The anonymisation process can use various techniques to achieve the k-threshold; several of these will be explored in theory and exercises in terms of how they contribute towards k-anonymity. The course introduces the theoretical foundations, and it complements the understanding with exercises and discussions. It also shows how to apply the 5-step process promoted by Singapore’s Personal Data Protection Commission (PDPC) and the Association of Southeast Asian Nations (ASEAN)’s Anonymisation Guides. Exercises will use the Academy’s own learning tool.

The course also covers legal aspects of anonymisation as far as relevant for the understanding and practical use of k-anonymity. It further addresses risk considerations for assessing the sufficiency of anonymisation. Though more technical in nature, this course is suitable for managers and directors to get a better understanding of anonymisation, and how to address and manage re-identification and other threats as part of their risk management responsibilities.

This course complements our Pseudonymisation Primer course.

Who should attend?

• Privacy Engineers, Technical Staff, Developers, Data Analysts, Data Architects, and Project Managers
• Data Protection Officers (DPOs), Compliance Professionals, and Corporate / In-house Counsels
• Executives, Managers, and Staff involved in the management, collection, use or other processing of personal data

Course Details

Course Outline

• Data anonymisation:
• Anonymity and data anonymisation
• Data attributes
• Keep data secret versus keep identity secret versus protect new insights

• Brief introduction to legal aspects under Personal Data Protection Act (PDPA)

• Identification, Identifiability, and sensitivity of data:​
• Anonymisation scale
• PDPC and ASEAN Guide's release models

• PDPC and ASEAN Guide’s 5 step process
• Key techniques and exercises
• Utility versus information loss: Basics of information content and information entropy

• Origin and intent of k-anonymity
• Concept of equivalence class
• k-Anonymity: Protection against re-identification and limitations
• Exercises on small and complex data sets

Course Facilitator

Albert Pichlmaier   Senior Cybersecurity and Privacy Engineer Senior Learning Technology Designer, Drew Data Protection & Cybersecurity Academy