Differential privacy is a mathematical way to limit what any output reveals about one person. A mechanism adds calibrated random noise so that the result looks almost the same whether or not your record is included. A parameter called epsilon sets the trade off between privacy and accuracy.
What the guarantee says
NIST describes differential privacy in its Special Publication 800-226 as a framework for measuring the privacy loss an individual faces when their data is included in a dataset. The key idea is a bound on that loss, not a promise about any particular dataset.
Smaller epsilon means stronger privacy and noisier results. Larger epsilon means more accurate results and weaker protection. There is no single right value; it depends on the data, the audience and the number of queries.
Where it fits
Differential privacy works best for aggregates over many people:
- Counts, sums and averages published to a dashboard.
- Usage statistics sent from devices to a server.
- Training machine learning models where memorising a person is a concern.
It does not suit small datasets, one off lookups of a single record, or cases where exact values are required.
Two common deployment models
- Central. A trusted server holds raw data and adds noise to answers. Accuracy is better, but you must trust and secure the server.
- Local. Each device adds noise before sending. No raw data leaves the device, but you need more users to get a useful signal.
The privacy budget
Every query consumes some of the budget. Ask enough questions and the noise can be averaged out, which defeats the protection. A real system tracks cumulative epsilon per dataset or per person and stops answering when it runs out.
That means differential privacy is a system, not a library call. You need budget accounting, access control over who can query, and a decision on what happens when the budget is spent.
Pitfalls NIST calls privacy hazards
The NIST guidance lists hazards that arise in practice. Examples in general terms include bugs in noise generation, using a weak random source, floating point issues, side channels such as timing, and misreading the parameters. Use a well reviewed, maintained library rather than writing your own, and test it.
Also remember the unit of protection. A guarantee per record is not a guarantee per person if one person contributes many records. Define the unit carefully.
Relation to GDPR
Differential privacy is evidence in an anonymisation assessment, not a stamp. Recital 26 asks about means reasonably likely to be used. Document the parameters, the threat model and the reasoning, and involve your privacy lead.
Quick check
Does adding noise to a dataset once make it anonymous?
Not by itself. The guarantee comes from the mechanism, the budget and the release process, not from noise alone.
What epsilon should we choose?
It depends on context. Start with published guidance such as NIST SP 800-226 and agree the number with a privacy specialist.
Sources
Last reviewed: 19 October 2026.
