Singapore PDPA anonymisation FAQ

No. PDPC guidance treats de-identification as the removal of direct identifiers, while anonymisation requires a broader risk assessment. A dataset with names, mobile numbers, or NRIC numbers removed may still be personal data if indirect identifiers such as age, postal code, job role, transaction patterns, or other attributes can be combined with available information to identify someone.

Pseudonymisation can help remove a direct identifier by replacing it with an unrelated value, but it does not automatically make the dataset anonymised. If a mapping table, key, algorithm, or other linkable dataset can be used to connect the pseudonym back to a person, that re-identification path must be controlled and assessed.

PDPC's technical guide gives techniques such as attribute or record suppression, character masking, generalisation, swapping, perturbation, synthetic data, and aggregation. A team may combine techniques to preserve the utility it needs, but applying a named technique does not settle the legal question; the release model and residual re-identification risk still control the conclusion.

PDPC guidance says data that has been anonymised is no longer considered personal data for the purposes of the PDPA. That conclusion depends on the facts: the data itself, information the recipient has or is likely to have, the extent of disclosure, the recipient's ability and motivation to re-identify, and the safeguards used to reduce re-identification risk.

Teams should therefore document why there is no serious possibility of re-identification for the specific release model. Internal analytics, controlled external sharing, ongoing data feeds, and public disclosure have different risk profiles; public disclosure generally needs stronger anonymisation because technical controls are limited once data is open.

Keep an anonymisation record that explains the purpose, utility needed, release model, attribute classification, techniques applied, risk calculation or assessment method, residual risk decision, safeguards, approval owner, and review trigger. PDPC guidance states that anonymisation process details, parameters, and controls should be recorded for review, maintenance, fine-tuning, and audits, while also being kept securely because the parameters themselves can assist re-identification.

Safeguards should match the residual risk and access model. Supported examples include limiting recipients and access, imposing use and onward-disclosure restrictions, requiring recipient processes for proper use and destruction, securing mapping tables and keys, using encryption or access controls, revocable or query-only access, releasing subsets, auditing recipients, and regularly reviewing controls.

PDPC's basic guide is introductory and limited to structured, textual, non-complex datasets. It says the recommendations are not exhaustive and adopting them does not by itself establish PDPA compliance. Large longitudinal datasets, sensitive data, and non-textual material such as audio, video, images, or biometrics may require different techniques and specialist assessment.