<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-privacy-enhancing-technologies
description: >-
  Implement Privacy Enhancing Technologies (PETs) including differential privacy, k-anonymity, pseudonymization, secure multi-party computation, and homomorphic encryption for data minimization and compliance.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - pet
  - differential-privacy
  - k-anonymity
  - pseudonymization
  - data-minimization
  - gdpr
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  frameworks: ["GDPR Art. 25", "NIST PF", "ISO 29101"]
---

# Implementing Privacy Enhancing Technologies

## Overview

Privacy Enhancing Technologies (PETs) operationalize Privacy by Design (GDPR Art. 25) by embedding technical controls that minimize personal data exposure. The right PET depends on the use case — analytics, sharing, computation, or storage — and the acceptable utility trade-off.

Mode: `[MODE: PRIVACY]` — Anonymization is not a binary. Quantify the re-identification risk.

## PET Selection Matrix

| Use Case | Recommended PET | Privacy Guarantee | Utility Trade-off |
|---|---|---|---|
| Release aggregate statistics | Differential privacy | Provable bound on individual inference | Noise reduces precision |
| De-identify datasets for sharing | k-anonymity + l-diversity | Re-identification resistance | Generalization loses detail |
| Pseudonymize user records | Pseudonymization (keyed hash) | Unlinkable without key | Re-linkable — key must be protected |
| Compute on encrypted data | Homomorphic encryption | Data never decrypted | Very high compute cost |
| Multi-party analytics | Secure MPC | No party sees others' inputs | Protocol complexity, latency |
| Synthetic data generation | Synthetic data | Statistical fidelity, no real records | Distribution may not match edge cases |
| Consent management | Data vaulting | Individual controls own data | Access latency |

## Pseudonymization Implementation

```python
import hashlib, hmac, os

class Pseudonymizer:
    """HMAC-SHA256 pseudonymization with secret key."""
    def __init__(self, secret_key: bytes | None = None):
        self.key = secret_key or os.urandom(32)  # Store securely — loss = unrecoverable

    def pseudonymize(self, identifier: str) -> str:
        return hmac.new(self.key, identifier.encode(), hashlib.sha256).hexdigest()

    def batch(self, identifiers: list[str]) -> dict[str, str]:
        return {uid: self.pseudonymize(uid) for uid in identifiers}
```

Key management requirements: HSM or secrets manager, rotation policy, access audit log.

## Differential Privacy Parameters

| Parameter | Meaning | Typical Values | Notes |
|---|---|---|---|
| ε (epsilon) | Privacy budget — smaller = stronger privacy | 0.1 (strong) to 10.0 (weak) | ε < 1 recommended for sensitive data |
| δ (delta) | Probability of privacy failure | 10⁻⁶ to 10⁻⁸ | Should be < 1/dataset_size |
| Sensitivity | Max change one record causes in output | Dataset-specific | Determines noise scale |
| Noise mechanism | How noise is added | Laplace (count), Gaussian (ML) | Laplace for pure DP, Gaussian for approximate |

## k-Anonymity Requirements

| k Value | Protection Level | Suitable For |
|---|---|---|
| k=2 | Minimal — easily re-identified with aux data | Not recommended |
| k=5 | Moderate | Low-sensitivity internal analytics |
| k=10 | Standard | Research datasets, published statistics |
| k=20+ | Strong | Medical, financial, sensitive demographics |

k-anonymity alone is insufficient — also apply l-diversity (sensitive attribute diversity) and t-closeness (distribution similarity).

## Compliance Mapping

| GDPR Obligation | PET That Satisfies It |
|---|---|
| Art. 5(1)(c) — Data minimization | Pseudonymization, synthetic data, aggregation |
| Art. 25 — Privacy by design | PET embedded in system architecture |
| Art. 89 — Research / archiving safeguards | k-anonymity, differential privacy for published data |
| Anonymization (removes GDPR scope) | Must withstand singling-out, linkability, inference test |

## Verification

- [ ] PET selection documented with use case and threat model justification
- [ ] Pseudonymization keys stored in HSM or secrets manager, not in application
- [ ] Differential privacy ε and δ values reviewed by privacy team
- [ ] k-anonymity datasets validated: no quasi-identifier combination with k < threshold
- [ ] Re-identification risk assessment documented before data sharing
- [ ] PET implementation tested against representative adversarial re-identification attempt

## Related Techniques

- [Detecting Unauthorized Profiling](../detecting-unauthorized-profiling/SKILL.md)
- [Performing Data Protection Impact Assessment](../conducting-data-protection-impact-assessment/SKILL.md)
