Privacy-enhancing technologies (PETs)

The OECD groups PETs into families: data obfuscation tools, such as differential privacy, synthetic data and anonymization techniques; encrypted data processing tools, such as homomorphic encryption, secure multi-party computation and trusted execution environments; federated and distributed analytics, such as federated learning; and data accountability tools that control and track how data are used.

PETs are a practical way to implement data protection by design and by default (GDPR Art. 25; LGPD Art. 46, §2) and appropriate security measures. They can make a legitimate interest balancing test or a transfer impact assessment more favourable. They are not a legal basis, however, and their effect depends on configuration: a differential privacy budget set too high, or a federated model that memorises records, can still leak information.

In AI projects, PETs help train or evaluate models without centralising raw personal data. Example: several hospitals train a diagnostic model with federated learning, so patient records never leave each hospital, and add differential privacy to the shared updates. The choice should be recorded in the DPIA.