Anonymization

Under GDPR Recital 26, data protection rules do not apply to information that no longer relates to an identifiable person, taking into account all the means reasonably likely to be used, such as cost, time and available technology. The LGPD (Art. 5, III and Art. 12) adopts the same logic, with one nuance: data are not anonymous if the process can be reversed with reasonable effort or using the controller's own means.

Anonymization is a result, not a technique. Removing names is rarely enough: combinations of postcode, birth date and gender can single people out, and AI models can memorise records from their training data. Assessments usually test three risks: singling out, linkability and inference. ISO/IEC 20889 describes techniques such as generalisation, aggregation and noise addition.

Example: a hospital publishing research statistics aggregates results into groups large enough that no patient can be re-identified, and reviews that conclusion as new external datasets appear. If re-identification remains possible, the data are only pseudonymized and the law still applies.