How to share data analysis without exposing personal information
Share only the minimum data needed for the purpose. Remove direct identifiers, separate lookup keys, mask or tokenize fields when linkage is required, aggregate or generalize quasi-identifiers, suppress small groups, and review every export for re-identification and hidden metadata. Access controls and retention limits remain necessary after masking.
From the field · People analytics lead
Share an HR compensation analysis without exposing an employee
A report contains name, work email, team, location, job level, salary, and performance rating. Removing name and email is insufficient when a unique job-level and location combination still identifies a person.
Columns used in the example
employee_id · name · email · team · location · job_level · salary · rating
Follow it with your own file
- Remove direct identifiers that are not needed for the decision.
- Assess combinations of quasi-identifiers and generalize location or job level where groups are too small.
- Aggregate salary and rating distributions to the minimum necessary detail.
- Inspect exports, chart labels, comments, filenames, and hidden workbook content before sharing.
Check: Try to identify records using the remaining fields and expected recipient knowledge. Confirm every published group meets the approved threshold and that lookup keys and raw exports are stored separately with access controls.
What needs resolving first
Teams need to share findings but files contain names, emails, phones, addresses, account IDs, free text, or rare demographic combinations. Hiding a column does not remove it.
Build the result step by step
- Define purpose and minimum fields: State the recipient’s decision and select only necessary rows, columns, period, and detail.
- Classify identity risk: Identify direct identifiers, sensitive attributes, quasi-identifiers, free text, and linkage keys in combination.
- Choose protection by use: Remove fields, tokenize linkage, mask display, generalize categories, aggregate, and suppress small groups as appropriate.
- Audit export and access: Inspect hidden sheets, comments, formulas, metadata, filenames, labels, recipients, and retention.
Protection is contextual
A customer ID may be harmless in one place and identifying where a lookup exists. Postcode, age, and role may identify a person after names are removed. Consider recipient, linked data, and purpose.
Anonymization is a high bar
Replacing names with tokens is pseudonymization, not guaranteed anonymization. If a key or distinctive attributes reconnect the record, obligations remain. Masking alone does not make data anonymous.
What changes the answer
- Minimization is safer than hiding columns.
- Combinations of fields can identify people.
- Masking, tokenization, anonymization, and aggregation differ.
- Inspect formulas, comments, hidden sheets, filenames, and labels.
Data-protection techniques
| Technique | Purpose | Limitation |
|---|---|---|
| Removal | Exclude a field | Other fields may identify |
| Masking | Hide displayed value | Original may remain elsewhere |
| Tokenization | Preserve controlled linkage | Mapping must be protected |
| Aggregation | Share group results | Small groups can disclose |
Warning signs in the file
- Recipients need totals but receive customer rows.
- Identifiers appear in chart labels.
- A masked file retains a lookup sheet.
- Small segments make individuals inferable.
Doing these steps in Prepyr
Prepyr accepts CSV files only. Export the worksheet or table you need as a UTF-8 CSV first; workbook formulas, formatting, macros, charts, and other sheets will not be included. Describe the result you need: Remove, mask, or aggregate personal information before sharing a spreadsheet. Check the columns selected, preview any proposed changes, and compare the output with the source before applying or exporting it.
Prepyr steps used here: PII review · Protected AI context · Report export · Email sharing
Make the output easy to check
- Purpose documented
- Minimum fields selected
- Identifiers reviewed
- Small groups checked
- Hidden content removed
- Access and retention controlled
A purpose-limited deliverable that communicates the result while reducing unnecessary exposure and recording protection decisions.
Questions readers usually ask next
Is hiding an Excel column enough?
No. Hidden columns remain in the file. Remove them from the shared export.
What is a quasi-identifier?
An attribute that may identify someone in combination, such as age, postcode, employer, and rare role.
Does masking make data anonymous?
Not necessarily. If a mapping or other attributes reconnect the record, it remains identifiable or pseudonymized.