A dataset is k-anonymous when every combination of quasi-identifiers, such as age band, postcode area and gender, appears in at least k records. That makes each person indistinguishable from at least k minus one others on those fields. It helps, but it does not guarantee anonymity under GDPR.
The idea in one example
Imagine a table of patients with age, postcode and diagnosis. Names are removed. If only one 34 year old lives in a given postcode and appears in the table, anyone who knows that person's age and postcode can find the row and read the diagnosis.
Quasi-identifiers are the fields that are not identifiers alone but identify in combination. Choose k, often 5 or more in practice depending on context, and then generalise fields until each combination appears k times: exact age becomes a ten year band, a full postcode becomes its first characters.
How to check it
Group the table by your chosen quasi-identifiers and count rows per group. The smallest count is your k.
In SQL, that is a group by with a count, then the minimum of the counts. If the minimum is below your target, you either generalise further, suppress the small groups, or drop a field.
Run the check each time the data is regenerated. A new column can silently lower k.
Where it breaks
k-anonymity protects against linking on the chosen fields only. Known weaknesses:
- Homogeneity. If all k people in a group share the same sensitive value, such as the same diagnosis, the attacker learns it anyway.
- Background knowledge. An attacker who knows extra facts can narrow a group.
- Other fields. If you left out a quasi-identifier, such as a rare job title, the check says nothing about it.
- Multiple releases. Two k-anonymous releases of overlapping data can be joined to break both.
- Free text and high-dimensional data. Location trails and browsing history are unique to individuals even after generalising.
Extensions exist that also require diversity in the sensitive field. They help, with their own limits.
What GDPR asks
Recital 26 says to consider "all the means reasonably likely to be used", including singling out, with attention to cost, time and available technology. A passing k value is evidence in that assessment, not a legal conclusion. The UK regulator's anonymisation guidance frames the goal as reducing the risk to a sufficiently remote level and notes that it is good practice guidance, not a statutory code.
When to use it
k-anonymity suits releasing a small table or an extract to a partner or researcher where you can control the fields. It is a poor fit for high dimensional, continuously updated data. There, consider aggregation or differential privacy, and keep the data inside a controlled environment rather than releasing it.
Quick check
What value of k should I use?
There is no universal number. Pick it from the sensitivity of the data and who will receive it, document the reasoning, and have a privacy specialist review it.
Is a k-anonymous dataset out of scope of GDPR?
Not automatically. You must still assess whether people remain identifiable by means reasonably likely to be used.
Sources
Last reviewed: 19 October 2026.
