Data licensing guide
Data licensing guide

How de-identification works when you license company data

By Ade Molajo · Updated · How we check figures

Quick answer

De-identification removes or transforms information that identifies people before data is used. micro1 says it removes or transforms personal information before sharing data with third parties. Mode says it removes sensitive material and removes or transforms personal identifiers before onward delivery. Mercor says it extracts and anonymises automatically and that no lab or vendor sees raw data. Ask each for its method and standard in writing.

All 3
programmes say they de-identify
4 steps
direct, indirect, free text, test
Free text
is the hardest part
In writing
get the method and standard

01What each programme says

ProgrammeWhat it says about de-identification
micro1Removes or transforms personal and identifying information before data is shared with third parties; no need to anonymise first
ModeRemoves sensitive material and removes or transforms personal identifiers, such as names and contact details, before onward delivery
MercorAutomated extraction and anonymisation; no lab or vendor sees raw data

Each programme's own pages, checked 30–31 October 2026.

02How it works, in general

De-identification in four steps: remove direct identifiers such as names and emails, treat indirect ones such as dates and job titles, scrub free text, then test whether anyone could be re-identified.01DirectNames, emails, IDs02IndirectDates, roles,places03Free textNotes and messages04TestCould anyonere-identify?
The general shape. Each programme describes its own method.
  1. Direct identifiers: names, emails, phone numbers, account numbers.
  2. Indirect identifiers: dates, job titles, locations, rare details that identify someone in combination.
  3. Free text: notes, messages and comments, where people mention each other. The hardest part to do well.
  4. Test: could anyone re-identify a person from what's left, alone or combined with other data?

03Does it take the data outside the law?

Does UK GDPR apply to the data you license? If the records hold no personal data, or it has been properly anonymised, it does not. Pseudonymised data, with names swapped for codes, is still personal data, so UK GDPR applies.YesYesNoNoAny personal data init?Properly anonymised?Outside UK GDPRUK GDPR applies(pseudonymised too)UK GDPR doesn’t apply
From the ICO’s anonymisation guidance. General information, not legal advice.

Only if it's properly anonymised. Under UK GDPR, pseudonymised data is still personal data. For US health data, HIPAA sets two standards. See anonymised vs pseudonymised.

04What to ask

Ask each programme for its method, the standard it works to, whether you see a de-identified sample first, and who carries the risk if it fails. This isn't legal advice.

05Check whether you're likely to match

Our free fit check asks about your size, location, records and tools, then shows which programmes you're likely to match. The programme decides.

06Questions people ask

Do I need to anonymise data before licensing it?

micro1 says no; it handles de-identification. Mode and Mercor also de-identify. But the legal responsibility for what you hand over starts with you.

Is de-identified data the same as anonymised?

Not always. Under UK GDPR only properly anonymised data is outside the law; pseudonymised data is still personal data. See our comparison.

Sources

Check which programmes you’re likely to matchA few short questions, about a minute. Free, no sign-up. The programme decides who qualifies.trackimpact.io/data →