De-identified data,
in plain English.

Personal information and de-identified information

The Privacy Act 1988 protects personal information, defined in section 6(1) as "information or an opinion about an identified individual, or an individual who is reasonably identifiable". De-identified information is information that is no longer about an identifiable or reasonably identifiable individual. Once information has been through an appropriate de-identification process, it is no longer personal information and falls outside the Act's protections (OAIC, De-identification and the Privacy Act).

The word doing the work is "reasonably". The OAIC's position is that someone is reasonably identifiable where re-identification is technically possible and there is a reasonable likelihood of it occurring. Whether that is so depends on the nature and amount of information, who holds it, what other information they can get, and how practical identification would be.

Re-identification risk depends on context

De-identification is not a property of a file on its own. The OAIC says the same dataset can be personal information in one setting and de-identified in another, depending on the environment it is released into: the other data available, the people with access, the infrastructure and the governance around it. It calls de-identification "a risk management exercise, not an exact science", and sets the bar plainly: for data to be considered de-identified, the risk of re-identification in the data access environment must be very low, meaning no reasonable likelihood of re-identification.

That is why releasing data to the open internet is treated differently from supplying it to a named party under contract. The OAIC notes that open data environments are generally only appropriate for information that has been through "an extremely robust de-identification process", while controls in the access environment can preserve more of the data's usefulness than heavy modification would.

De-identification techniques, in plain English

The OAIC describes de-identification as two steps: remove direct identifiers, then deal with what remains, either by altering the data, by controlling the environment, or both.

• Removing direct identifiers. Names, addresses, emails, phone numbers and account numbers come out. This is necessary and, on its own, not enough. In the OAIC's words, removing name, address or other direct identifiers alone "may not result in de-identification for the purposes of the Privacy Act".
• Treating quasi-identifiers. Some details identify people in combination: significant dates, profession, income, or a rare characteristic. The OAIC lists techniques including sampling, rounding, perturbation, swapping and synthetic data. Generalisation is the everyday version: an exact date becomes a month, an exact figure becomes a band.
• Pseudonymisation, and why it alone is not enough. Replacing a name with a consistent code keeps records linkable, which is useful, but it only deals with the direct identifier. The surrounding detail can still point to one person, which is exactly the gap the OAIC warns about.
• Context and access controls. Limiting who can access the data, using secure environments, restricting distribution and contractually prohibiting re-identification are all part of the OAIC's toolkit, not afterthoughts.

For a structured method, the OAIC and CSIRO's Data61 publish the De-identification Decision-Making Framework, first released in 2017 and adapted from the UK's Anonymisation Decision-Making Framework. The OAIC notes some of its content may now be out of date and points to a 2025 resource from Asia-Pacific privacy authorities alongside it.

Why buyers contractually bind non-re-identification

Because re-identification risk depends on who holds the data and what else they hold, the contract is part of the de-identification, not paperwork around it. A buyer that agrees not to attempt re-identification, not to combine the data with other sources to that end, and not to pass it on, is a controlled environment in the OAIC's sense.

The Spirit Airlines records sale shows what happens when this is in doubt. Unions and consumer advocates objected that personal information of former employees and customers was in the data set. micro1's competing bid added commitments to independent de-identification, a 1% sample for review, destruction of raw employment records after processing, and transfer only to named AI-laboratory customers under confidentiality agreements (Fortune, 14 September 2026).

Even de-identified data keeps some obligations in view. The OAIC flags APP 6 where shared data could become personal information again, APP 8 where an overseas transfer could enable re-identification, and APP 11, because de-identified data should still be stored securely.

How Wildcatt applies de-identification

Wildcatt wants a business's operational data: how work came in, how decisions were made and what outcomes they led to. It does not want customer data. People are not the product, so where staff, customers or counterparties appear in the working record, they come out:

• Extraction is read-only, into an isolated, encrypted, per-client environment in an Australian region.
• More than 60 identifier types are irreversibly removed or transformed before any dataset is evaluated by or shown to a buyer. Customers' own data and third-party content are excluded at extraction.
• Every removal is written to an audit ledger that travels with the dataset: what was transformed, by which rule, and when.
• Buyers receive only the prepared copy, under a licence that binds them to non-re-identification and to a defined use, term and territory, and bars onward transfer.
• Raw extracts are deleted after delivery, confirmed in writing.

The operational detail is on our security and trust pages. If you want to know what your record would look like as a data asset before deciding anything, start with the data inventory guide and the instant range, or read how this fits into data monetisation in 2026 and selling company data in Australia. There is nothing to pay.

Sources: OAIC, De-identification and the Privacy Act; OAIC and CSIRO Data61, De-identification Decision-Making Framework; Fortune, 14 September 2026. General information, not legal advice. Whether data is de-identified depends on the specific data and the environment it is released into.