What it covers. NIST guidance on de-identifying datasets before release or sharing, aimed at government agencies but useful to any organisation. It covers governance, risk assessment and techniques for removing or transforming identifying information while preserving usefulness of the data.
In practice. Organisations set up a governance process that decides what may be released and to whom, assess re-identification risk, and choose suitable techniques such as suppression, generalisation, noise addition or synthetic data. Releases are documented and reviewed, and the effectiveness of de-identification is tested. Evidence includes release decisions, risk assessments and descriptions of methods used.
Common gaps. Common gaps are assuming that removing names is enough, ignoring linkage with other datasets and no ongoing review as new data becomes available.