Dataset de-identification is the removal of personal detail from a pooled virtual-care collection. Using confidential patient information without consent normally needs support under section 251 of the NHS Act 2006, operated through the Health Service (Control of Patient Information) Regulations 2002. The Confidentiality Advisory Group at the Health Research Authority advises on those applications. Genuine anonymisation avoids the question, because Recital 26 puts anonymous information outside the UK GDPR. anonym.plus does the work on your device.
When this applies
A research set pools consultations, messages, and outcomes from many patients. Each row still ties back to a person through a name, an email, or a device handle. Pooling raises the risk that a rare combination identifies someone even after the obvious fields go.
How anonym.plus handles it
- Open the pooled set in anonym.plus on a local device.
- It scans identifier columns and free-text fields alike.
- Outcome and visit-type columns stay in place.
- Swap the personal parts with the map turned off.
- Save the anonymous collection on your machine.
What you need to provide
- The collection (CSV, JSON, or a record bundle).
- Replace with the re-link map off for anonymity.
- Optional column map for identifier fields.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | patient column → [PATIENT_n] |
| Contact | EMAIL_ADDRESS | contact email → [EMAIL] |
| Identifiers | ID | device handle → [DEVICE] |
| Network | IP_ADDRESS | session IP → [IP] |
| Dates | DATE_TIME | visit date → shifted [TIME] |
| Free text | LOCATION | inline city → [PLACE] |
Compliance achieved
- True anonymity puts the set outside scope by UK GDPR Recital 26.
- Removes special category health content that would otherwise sit under UK GDPR Art. 9(1).
- Reduces reliance on the consent-free route in section 251 of the NHS Act 2006.
- That route runs through the Health Service (Control of Patient Information) Regulations 2002 (SI 2002/1438).
- Applications for it are advised on by the HRA Confidentiality Advisory Group.
- Residual risk is judged with the ICO motivated-intruder test before release.
Anonymise virtual care datasets offline — see plans & start free →
Limitations & cautions
A pooled set raises re-identification risk, because rare combinations across rows can single out one person. Coarsen the dates and small postcodes, keep no re-link key, and run the motivated-intruder test before you call the collection anonymous.
Frequently asked questions
Do we still need section 251 support if the set is anonymised?
Generally not, because section 251 exists to permit the use of confidential patient information without consent. Once information is genuinely anonymous it is neither confidential nor personal data. The catch is that the anonymisation itself is done on identifiable records, so the step producing the set still has to be lawful.
What does the Confidentiality Advisory Group do?
The CAG at the Health Research Authority advises on applications to use confidential patient information without consent, under the Control of Patient Information Regulations 2002. It is an advisory step in the section 251 route, not a substitute for a data protection assessment.
Do the outcome columns stay?
Yes. Outcomes and visit types remain intact. Only the personal fields and the free-text clues around them are removed.