Why masking a name may leave a person identifiable

Replace a customer’s name with ‘Customer A’ and the sentence may still say: the only violin teacher in a particular village, booked for a named event on a precise date. Someone familiar with the setting may not need the original name to recognise the person.

Masking can be useful, but its effect depends on what remains and who receives it. Treat the transformed record as something to assess, rather than assuming that an absent name makes it anonymous.

Start with identifiability

The DPDP definition in section 2(t) concerns an individual identifiable by or in relation to the data. The definition is already commenced. As of 22 October 2026, the relevant substantive business duties are scheduled for 13 May 2027 under the commencement notification.

That definition directs attention to context and relationships, not just obvious identity fields. A record can lack a name while retaining an account reference, a distinctive narrative or a combination of attributes that links it to someone.

NIST SP 800-188 likewise treats de-identification as an assessment involving disclosure risk and the proposed sharing model. It distinguishes removing direct identifiers from broader techniques and warns that tools which merely mask information may not provide sufficient de-identification functionality. This is technical guidance; it does not replace the Indian legal test.

Distinguish three kinds of change

Masking hides part or all of a visible value. A partially hidden number may still be useful to recognise an account, and other fields can remain untouched. Ask what the recipient can infer from the visible portion and its context.

Replacing a value with a consistent pseudonym preserves a link across records. That can be valuable for a legitimate analysis, but the link is itself relevant to privacy. If a separate mapping can restore the original identity, the map requires its own controls and the transformed data should not automatically be described as anonymous.

Removing or generalising contextual detail can reduce distinctiveness, but it may also reduce the usefulness of the data. The right choice depends on the task and the audience. There is no universal transformation that makes every record safe for every release.

A hypothetical customer-service report

A business wants to share a support case with a training group. It removes the customer’s name but leaves a precise location, a rare occupation, an exact appointment date and a screenshot containing an order reference.

The reviewer asks what the training exercise actually needs. The group is learning how to explain a delay, so the exact location and occupation add little. The reviewer replaces them with broader descriptions, uses a synthetic screenshot and removes the linkable reference. The revised example still teaches the communication problem.

The reviewer then considers the audience. A small internal group with additional customer knowledge may be able to recognise a case that an outside reader could not. The sharing decision therefore includes access and context, not only changes to the text.

Check the complete file

Visible text is only one part of a document. Comments, filenames, embedded images, hidden sheets and metadata can preserve information that the main page no longer shows. Inspect the final exported format that recipients will actually receive.

If a masking tool processes a document, test whether it covers the relevant content types and whether the saved output contains the intended transformation. A preview is not automatically evidence of every layer in the delivered file. Use synthetic fixtures with known expected results to make the test inspectable.

Avoid describing a detector’s silence as proof of anonymity. A detector may be designed to identify particular patterns or entity types; contextual identification can require a different assessment.

Match the claim to the evidence

Useful descriptions are specific: direct names removed, phone numbers partially masked, account identifiers replaced, or a restricted training example prepared. ‘Fully anonymous’ is a much stronger conclusion and needs a defined context and supporting analysis.

Record the intended recipient, purpose, transformations, remaining links and limitations. If the data remains identifiable, apply the appropriate privacy controls rather than trying to improve the label. If the task can be completed with a synthetic example, that may avoid using the real case, although synthetic material derived from confidential data still needs its own assessment.

The recurring failure is confusing a visible edit with a change in the data’s legal or practical character. Ask whether this recipient could still identify the person, using the information and relationships that remain. That question leads to a more useful decision than checking whether the name field is blank.