Business data anonymisation: what changes and what stays useful?
A practical example of name replacement, the details that still need review and the questions to ask before data leaves your company.
Replacing a name is easy to picture. Deciding whether a person can still be identified takes more care. Here is how to separate a useful illustration from evidence that a dataset is ready to share.
What does name replacement look like?
Imagine three made-up records. In a support ticket, Jim Smith reports a delivery problem. In an email, Jim Smith approves a replacement. In the CRM, the team records Jim Smith's issue as resolved. Replacing each occurrence with Person 14 keeps the story connected without showing that name. These are fictional examples, not customer records.
Why is Person 14 not enough on its own?
A rare job title, an exact date and a distinctive incident might reveal the person even after the name is gone. Under UK ICO guidance, pseudonymisation is not the same as anonymisation. The review must consider whether someone remains identifiable, including through other information. A reassuring label is not evidence of that review.
What should we ask the preparation team?
Before transferring any data, request clarification about which fields will be removed, replaced or made less specific. Ask how free-text communications and attachments will be evaluated. Who reviews the result? What happens to records that cannot be made suitable? Get a clear explanation of the process and its limits before agreeing to a transfer.
Will the records still make sense?
Keep the question, the team's reasoning and the outcome, while removing information that should not be shared. Discuss a fictional before-and-after example relevant to your systems. A cleaned support conversation should still show how the issue was resolved. You do not need to keep every detail.
What about business secrets?
Removing personal identifiers does not decide whether a pricing method, confidential client project or internal strategy is appropriate to license. Put commercially sensitive material on a separate exclusions list. Some folders or record types may need to stay out entirely.
What do we share with Maryah first?
Start with counts and screenshots, not raw records. Show totals and date ranges, hiding names, messages and sensitive details in screenshots. Data moves only after a buyer deal is agreed. Ask about the proposed scope and preparation process during the conversation. This guide is general information, not a privacy assessment or legal advice.
Privacy reference: ICO: assessing whether anonymisation is effective. This is UK guidance, not a universal legal clearance.