SI-19 De-identification

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	8 (0 in a baseline)

Related controls: MP-6, PM-22, PM-23, PM-24, RA-2, SI-12

Control statement

• a. Remove the following elements of personally identifiable information from datasets: [Assignment: organization-defined elements] ; and
• b. Evaluate [Assignment: organization-defined frequency] for effectiveness of de-identification.

NIST discussion

De-identification is the general term for the process of removing the association between a set of identifying data and the data subject. Many datasets contain information about individuals that can be used to distinguish or trace an individual’s identity, such as name, social security number, date and place of birth, mother’s maiden name, or biometric records. Datasets may also contain other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. Personally identifiable information is removed from datasets by trained individuals when such information is not (or no longer) necessary to satisfy the requirements envisioned for the data. For example, if the dataset is only used to produce aggregate statistics, the identifiers that are not needed for producing those statistics are removed. Removing identifiers improves privacy protection since information that is removed cannot be inadvertently disclosed or improperly used. Organizations may be subject to specific de-identification definitions or methods under applicable laws, regulations, or policies. Re-identification is a residual risk with de-identified data. Re-identification attacks can vary, including combining new datasets or other improvements in data analytics. Maintaining awareness of potential attacks and evaluating for the effectiveness of the de-identification over time support the management of this residual risk.

Control enhancements

SI-19(1) Collection

Baselines: Not in a baseline

De-identify the dataset upon collection by not collecting personally identifiable information.

Discussion and assessment objectives for SI-19(1)

If a data source contains personally identifiable information but the information will not be used, the dataset can be de-identified when it is created by not collecting the data elements that contain the personally identifiable information. For example, if an organization does not intend to use the social security number of an applicant, then application forms do not ask for a social security number.

Determine if the dataset is de-identified upon collection by not collecting personally identifiable information.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; procedures for minimizing the collection of personally identifiable information; system configuration; data collection mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms preventing the collection of personally identifiable information.

SI-19(2) Archiving

Baselines: Not in a baseline

Prohibit archiving of personally identifiable information elements if those elements in a dataset will not be needed after the dataset is archived.

Discussion and assessment objectives for SI-19(2)

Datasets can be archived for many reasons. The envisioned purposes for the archived dataset are specified, and if personally identifiable information elements are not required, the elements are not archived. For example, social security numbers may have been collected for record linkage, but the archived dataset may include the required elements from the linked records. In this case, it is not necessary to archive the social security numbers.

Determine if the archiving of personally identifiable information elements is prohibited if those elements in a dataset will not be needed after the dataset is archived.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration documentation; data archiving mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with dataset archival responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms prohibiting the archival of personally identifiable information elements.

SI-19(3) Release

Baselines: Not in a baseline

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Discussion and assessment objectives for SI-19(3)

Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.

Determine if personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; procedures for minimizing the release of personally identifiable information; system configuration; data release mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset.

SI-19(4) Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers

Baselines: Not in a baseline

Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.

Discussion and assessment objectives for SI-19(4)

There are many possible processes for removing direct identifiers from a dataset. Columns in a dataset that contain a direct identifier can be removed. In masking, the direct identifier is transformed into a repeating character, such as XXXXXX or 999999. Identifiers can be encrypted or hashed so that the linked records remain linked. In the case of encryption or hashing, algorithms are employed that require the use of a key, including the Advanced Encryption Standard or a Hash-based Message Authentication Code. Implementations may use the same key for all identifiers or use a different key for each identifier. Using a different key for each identifier provides a higher degree of security and privacy. Identifiers can alternatively be replaced with a keyword, including transforming “George Washington” to “PATIENT” or replacing it with a surrogate value, such as transforming “George Washington” to “Abraham Polk.”

Determine if direct identifiers in a dataset are removed, masked, encrypted, hashed, or replaced.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; documentation of de-identified datasets; tools for the removal, masking, encryption, hashing or replacement of direct identifiers; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms supporting and/or implementing the removal, masking, encryption, hashing or replacement of direct identifiers.

SI-19(5) Statistical Disclosure Control

Baselines: Not in a baseline

Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.

Discussion and assessment objectives for SI-19(5)

Many types of statistical analyses can result in the disclosure of information about individuals even if only summary information is provided. For example, if a school that publishes a monthly table with the number of minority students enrolled, reports that it has 10-19 such students in January, and subsequently reports that it has 20-29 such students in March, then it can be inferred that the student who enrolled in February was a minority.

Determine if:

• SI-19(05)[01] numerical data is manipulated so that no individual or organization is identifiable in the results of the analysis;
• SI-19(05)[02] contingency tables are manipulated so that no individual or organization is identifiable in the results of the analysis;
• SI-19(05)[03] statistical findings are manipulated so that no individual or organization is identifiable in the results of the analysis.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; de-identified datasets; statistical analysis report; tools for the control of statistical disclosure; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms supporting and/or implementing the control of statistical disclosure.

SI-19(6) Differential Privacy

Baselines: Not in a baseline

Prevent disclosure of personally identifiable information by adding non-deterministic noise to the results of mathematical operations before the results are reported.

Discussion and assessment objectives for SI-19(6)

The mathematical definition for differential privacy holds that the result of a dataset analysis should be approximately the same before and after the addition or removal of a single data record (which is assumed to be the data from a single individual). In its most basic form, differential privacy applies only to online query systems. However, it can also be used to produce machine-learning statistical classifiers and synthetic data. Differential privacy comes at the cost of decreased accuracy of results, forcing organizations to quantify the trade-off between privacy protection and the overall accuracy, usefulness, and utility of the de-identified dataset. Non-deterministic noise can include adding small, random values to the results of mathematical operations in dataset analysis.

Determine if the disclosure of personally identifiable information is prevented by adding non-deterministic noise to the results of mathematical operations before the results are reported.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; de-identified datasets; differential privacy tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Online query systems; automated mechanisms supporting and/or implementing differential privacy.

SI-19(7) Validated Algorithms and Software

Baselines: Not in a baseline

Perform de-identification using validated algorithms and software that is validated to implement the algorithms.

Discussion and assessment objectives for SI-19(7)

Algorithms that appear to remove personally identifiable information from a dataset may in fact leave information that is personally identifiable or data that is re-identifiable. Software that is claimed to implement a validated algorithm may contain bugs or implement a different algorithm. Software may de-identify one type of data, such as integers, but not de-identify another type of data, such as floating point numbers. For these reasons, de-identification is performed using algorithms and software that are validated.

Determine if:

• SI-19(07)[01] de-identification is performed using validated algorithms;
• SI-19(07)[02] de-identification is performed using software that is validated to implement the algorithms.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; de-identified datasets; algorithm and software validation tools; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Validated algorithms and software.

SI-19(8) Motivated Intruder

Baselines: Not in a baseline

Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

Discussion and assessment objectives for SI-19(8)

A motivated intruder test is a test in which an individual or group takes a data release and specified resources and attempts to re-identify one or more individuals in the de-identified dataset. Such tests specify the amount of inside knowledge, computational resources, financial resources, data, and skills that intruders possess to conduct the tests. A motivated intruder test can determine if the de-identification is insufficient. It can also be a useful diagnostic tool to assess if de-identification is likely to be sufficient. However, the test alone cannot prove that de-identification is sufficient.

Determine if a motivated intruder test is performed on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; motivated intruder test procedures; de-identified datasets; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities.

Test: Motivated intruder test.

Assessment objectives (SP 800-53A)

Objectives and methods for SI-19

Determine if:

• SI-19a. [Assignment: organization-defined elements] are removed from datasets;
• SI-19b. the effectiveness of de-identification is evaluated [Assignment: organization-defined frequency].

Examine: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; system configuration; datasets with personally identifiable information removed; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records.

Interview: Organizational personnel responsible for identifying unnecessary identifiers; organizational personnel responsible for removing personally identifiable information from datasets; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements.

Policy statement

• The System owner shall remove the following elements of personally identifiable information from datasets that are to be de-identified: Fill in: elements of personally identifiable information to be removed from datasets Typical: direct identifiers such as names, addresses, identification numbers, contact details and full dates of birth, and any indirect identifiers the privacy review finds could re-identify individuals. (SI-19a)
• The Senior privacy official shall evaluate the effectiveness of de-identification Fill in: the frequency at which to evaluate the effectiveness of de-identification Typical: annually, and before each new release of a de-identified dataset. (SI-19b)

From the System and Information Integrity Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SI-19 asks you to remove the elements of personally identifiable information you name from datasets (a), and to evaluate, at a frequency you set, whether the de-identification works (b). SI-19 is in the SP 800-53B Privacy baseline only.

NIST’s SI-19 discussion defines de-identification as removing the association between identifying data and the person it is about. Trained individuals remove personally identifiable information when it is not, or no longer, needed for the dataset’s purpose; for a dataset used only for aggregate statistics, the identifiers those statistics do not need are removed. Information that is removed cannot be disclosed or misused. Re-identification remains a residual risk, because new datasets can be combined with the de-identified one and analysis techniques improve, so you keep track of possible attacks and evaluate the de-identification again over time. Some laws and regulations set their own definitions or methods of de-identification; follow them where they apply.

NIST SP 800-188, De-Identifying Government Datasets: Techniques and Governance (September 2023, current as of October 2026), is NIST’s guide. Its main points for an implementation:

• Removing direct identifiers is not enough. Quasi-identifiers, such as dates and geographic information, can be combined to single out a person, so they are transformed too (section 4.3).
• Formal privacy methods, such as differential privacy, should be preferred over informal methods where they are available and fit the task (executive summary).
• Agencies should consider having trained people do de-identification with software designed for it; general-purpose tools such as spreadsheets typically lack the functions it needs (executive summary).
• A Disclosure Review Board, with legal and technical privacy experts and leadership, reviews written applications to release de-identified data, both the method and its results; approvals may cover several releases but should not be valid indefinitely (section 3.6).
• Each de-identified dataset is validated for usefulness and for privacy protection, for example with a motivated intruder test (section 4.6).
• After a release, the agency monitors whether its assumptions still hold, because a dataset can become more identifiable over time (section 4.3.13).

Common implementations. The SI-19 clause of the System and Information Integrity policy (Privacy variant) has the system owner remove the named elements, and the senior privacy official evaluate the effectiveness. In practice:

• A de-identification procedure that follows SP 800-188’s process: set the acceptable re-identification risk, identify direct identifiers and quasi-identifiers, remove or replace the direct identifiers, model what other data an intruder could use, transform the quasi-identifiers, and measure the remaining risk.
• A review board, or the privacy office for a smaller organization, that approves each release or sharing of a de-identified dataset and keeps a record of what was released and how it was de-identified.
• Tools built for de-identification, with the method and settings recorded for each dataset.
• A register of de-identified datasets and their releases, so the evaluation under (b) knows what to re-check.

Record de-identified datasets made from a system’s information, and their recipients, in the system’s privacy impact assessment. PM-25 uses de-identified data in place of real data for testing, training and research, and SI-12 may use de-identification as a disposal method.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Elements removed from datasets (a)	Direct identifiers such as names, addresses, identification numbers, contact details and full dates of birth, and any indirect identifiers the privacy review finds could re-identify individuals
How often the effectiveness of de-identification is evaluated (b)	Annually, and before each new release of a de-identified dataset

These match the SI-19 clause. The second value follows SP 800-188: a release is evaluated before it goes out, and the yearly evaluation checks whether new data or techniques have raised the risk for datasets already released.

Evidence assessors ask for.

• The de-identification procedure, and the list of elements removed for each dataset
• The approvals for a sample of releases, with the method and the evaluation of re-identification risk
• Results of the last evaluation under (b), such as a motivated intruder test, and the actions taken
• Training records for the people who perform de-identification
• The register of de-identified datasets and where they were released

Inheritance. The privacy office, or a disclosure review board, provides the method, the approvals and the evaluation as common controls. Each system, or each team that produces a dataset, removes the elements, so SI-19 is usually hybrid.

Common findings.

• Names removed, but dates of birth, postal codes and other quasi-identifiers left in, so records can be linked to people.
• Hashing identifiers without a secret key, so anyone can hash a known value and match it.
• De-identification done by hand in a spreadsheet, with no record of the method.
• Datasets released once and never evaluated again.
• “De-identified” data shared under a label that leads recipients to treat it as non-personal, with no agreement against re-identification.

Enhancements. SI-19 has eight enhancements, all in no baseline: SI-19(1) collection, SI-19(2) archiving, SI-19(3) release, SI-19(4) removal, masking, encryption, hashing or replacement of direct identifiers, SI-19(5) statistical disclosure control, SI-19(6) differential privacy, SI-19(7) validated algorithms and software, and SI-19(8) motivated intruder. None has a clause in the policy template, but their discussions are a useful checklist. The SI-19(4) discussion notes that encryption and hashing use a key, such as with the Advanced Encryption Standard or a Hash-based Message Authentication Code, and that a different key for each identifier gives more protection.

Artifacts

• System and Information Integrity Decision Worksheet
• System and Information Integrity Policy