Actuarial dataset de-identification is the removal of personal data from a pricing extract. Once truly anonymous, it is no longer personal data under UK GDPR Recital 26 and falls outside the law, even though the same rows still feed the technical-provisions reserving work the PRA Rulebook requires under the UK's onshored Solvency II regime. anonym.plus does this on your own device.
When this applies
Pricing and reserving work lean on large extracts of historical rows that ultimately support the technical provisions a PRA-regulated insurer must hold. Sending those rows to a cloud tool is a disclosure risk before any reserving work even starts. Local work avoids it.
How anonym.plus handles it
- Point anonym.plus at the export folder on your server.
- It scans the ID columns and any free-text fields.
- Steady aliases keep cohort joins intact.
- Turn off the re-link key for true anonymity.
- Review the summary and tune the column rules.
- Save the clean table on your device.
What you need to provide
- The extract as CSV, JSON, or a bundle.
- A column map for known ID fields.
- Replace with the re-link key off for full anonymity.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | insured_name → [PERSON_n] |
| Policy ID | UK_HEALTH_INSURANCE_MEMBER | policy_id → [POLICY_n] |
| Dates | DATE_TIME | incept_date → shifted [DATE] |
| Age | AGE | exact age 91 → [AGE_90+] |
| Address | LOCATION | postcode → [REGION] |
| Account | ACCOUNT_NUMBER | acct field → [ACCOUNT_n] |
Compliance achieved
- True anonymity puts the table outside scope by UK GDPR Recital 26.
- Strips UK GDPR Art. 9 health identifiers from the rows.
- The same rows still support technical-provisions reserving under the PRA Rulebook's onshored Solvency II requirements — anonymising them does not change that separate obligation.
- On-device work supports UK data residency.
- Keeps cohort links steady, so the table stays useful for modelling.
Anonymise actuarial datasets offline — see plans & start free →
Limitations & cautions
An exact age above 89 is a re-identification risk and is grouped to 90+. A rare claim outlier in a small region can still narrow identity. Weigh the residual risk and keep no re-link key before you treat the table as anonymous.
Frequently asked questions
Why is age above 89 grouped?
Very high ages point to few people, so an exact age raises re-identification risk under the ICO's motivated-intruder test. The tool buckets ages above 89 into a 90+ band to lower that risk while keeping the age relevant for the pricing model.
Can cohorts stay linkable after the swap?
Only with an alias map, which makes the result pseudonymous rather than anonymous. For true anonymity under Recital 26, turn the map off so no key remains, even though the reserving obligation under the PRA Rulebook continues on the original data separately.
Does modelling still work on the clean table?
Yes. Aliases keep joins steady across rows, so cohort models used in pricing or Solvency II reserving calculations run normally while no real identity is left in the extract.