---
title: "Assess whether a dataset is de-identified before it is shared or released"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release"
type: "task"
site: "AI Law Framework"
id: "A25-Y20261018-9"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Assess whether a dataset is de-identified before it is shared or released

> From the dataset description, field list, the intended recipients and the release environment, build a table of each field and combination that could identify a person, the controls proposed (removal, aggregation,…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the dataset description, field list, the intended recipients and the release environment, build a table of each field and combination that could identify a person, the controls proposed (removal, aggregation, access limits, contractual restrictions), and the residual re-identification risks, following the OAIC's de-identification guidance. |
| What the lawyer must review | Decide whether the re-identification risk is very low in this release context so the data is not personal information, or whether the Privacy Act still applies, settle the contractual controls with the recipient, and advise on monitoring after release. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the dataset description, field list, the intended recipients and the release environment, build a table of each field and combination that could identify a person, the controls proposed (removal, aggregation, access limits, contractual restrictions), and the residual re-identification risks, following the OAIC's de-identification guidance.
- What the lawyer does: Decide whether the re-identification risk is very low in this release context so the data is not personal information, or whether the Privacy Act still applies, settle the contractual controls with the recipient, and advise on monitoring after release.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Confirm the instructions, the jurisdiction and the complete relevant material before starting.
2. Assess the risk in the actual release context, because de-identified status depends on context.
3. Check combinations of fields, not only direct identifiers.
4. Confirm contractual controls on the recipient match the assumptions in the assessment.
5. Check the output against the source documents named in it before it is relied on.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC: De-identification and the Privacy Act](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/handling-personal-information/de-identification-and-the-privacy-act) (checked 2026-10-18)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/de-identification-assessment-before-sharing-or-release.md) | Checklist | Yellow | Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data,… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-whether-a-dataset-is-de-identified-before-it-is-shared-or-release/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*