<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-anonymization-techniques
description: >-
  Implement data anonymization and pseudonymization techniques including
  generalization, suppression, masking, tokenization, and synthetic data
  generation to render personal data non-identifiable per GDPR Recital 26
  and Article 29 WP Opinion 05/2014.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - anonymization
  - pseudonymization
  - gdpr
  - masking
  - tokenization
  - synthetic-data
  - recital-26
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Anonymization Techniques

## Overview

Anonymization transforms personal data so that individuals cannot be identified
directly or indirectly, even with additional information (GDPR Recital 26). Truly
anonymized data falls outside GDPR scope. Pseudonymization (Art. 4(5)) reduces
risk but data remains personal. This skill implements generalization, suppression,
masking, tokenization, and synthetic data generation with re-identification risk
assessment.

Mode: `[MODE: PRIVACY]` — Data anonymization and pseudonymization engineering.

## Prerequisites

- Python 3.10+ with `json`, `hashlib`, `random` modules
- Data classification inventory (PII types identified)
- Understanding of quasi-identifiers in target datasets
- Re-identification risk tolerance thresholds
- Data utility requirements for downstream use cases

## Key Concepts

### Anonymization vs Pseudonymization

| Property | Anonymization | Pseudonymization |
|----------|---------------|------------------|
| GDPR scope | Outside GDPR | Within GDPR |
| Reversibility | Irreversible | Reversible with key |
| Data utility | Lower | Higher |
| Article | Recital 26 | Art. 4(5) |
| Re-identification | Not reasonably possible | Possible with mapping |

### Techniques

```python
ANONYMIZATION_TECHNIQUES = {
    "generalization": "Replace exact values with ranges (age 34 -> 30-40)",
    "suppression": "Remove identifying fields entirely",
    "masking": "Replace characters with wildcards (john@ex.com -> j***@**.com)",
    "tokenization": "Replace with random tokens, mapping stored separately",
    "noise_addition": "Add random noise to numeric values",
    "synthetic_data": "Generate statistically similar but fake records",
    "aggregation": "Replace individual records with group statistics",
}
```

### Scanning CLI

```bash
# Apply masking to PII fields
node scripts/agent.js --action mask \
  --input /tmp/dataset.json --fields "email,phone,ssn"

# Generalize quasi-identifiers
node scripts/agent.js --action generalize \
  --input /tmp/dataset.json --field "age" --bin-size 10

# Tokenize identifiers
node scripts/agent.js --action tokenize \
  --input /tmp/dataset.json --fields "user_id,email" \
  --output /tmp/tokenized.json

# Assess re-identification risk
node scripts/agent.js --action assess-risk \
  --input /tmp/anonymized.json --quasi-ids "age,zipcode,gender"
```

## Workflow

### Step 1: Identify Fields for Anonymization

```bash
node scripts/agent.js --action assess-risk \
  --input /tmp/dataset.json --quasi-ids "age,zipcode,gender"
```

### Step 2: Apply Masking

```bash
node scripts/agent.js --action mask \
  --input /tmp/dataset.json --fields "email,phone,ssn"
```

### Step 3: Generalize Quasi-Identifiers

```bash
node scripts/agent.js --action generalize \
  --input /tmp/dataset.json --field "age" --bin-size 10
```

### Step 4: Verify Anonymization Quality

```bash
node scripts/agent.js --action assess-risk \
  --input /tmp/anonymized.json --quasi-ids "age,zipcode,gender"
```

## Verification

- [ ] Direct identifiers removed or irreversibly masked
- [ ] Quasi-identifiers generalized to prevent re-identification
- [ ] k-Anonymity threshold met after anonymization
- [ ] Tokenization mapping stored separately with access controls
- [ ] Re-identification risk assessment completed
- [ ] Data utility validated for intended downstream use
- [ ] Anonymization process documented for accountability

## References

- [GDPR Recital 26 — Anonymized Data](https://gdpr-info.eu/recitals/no-26/)
- [GDPR Article 4(5) — Pseudonymization](https://gdpr-info.eu/art-4-gdpr/)
- [Article 29 WP Opinion 05/2014 on Anonymisation](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf)
- [ENISA Pseudonymisation Techniques](https://www.enisa.europa.eu/publications/pseudonymisation-techniques-and-best-practices)
- [ICO Anonymisation Code of Practice](https://ico.org.uk/media/1061/anonymisation-code.pdf)
