---
title: "De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/de-identification-assessment-before-sharing-or-release"
type: "precedent"
site: "AI Law Framework"
id: "a25-de-identification-assessment-before-sharing-or-release"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-Y20261018-9"]
law_stated_as_at: "2026-10-18"
---

# De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)

> Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data, the release…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/de-identification-assessment-before-sharing-or-release  
Law stated as at: 2026-10-18

Site index for agents: https://ailawframework.com/llms.txt

Record for deciding whether a dataset is de-identified (no longer about an identified or reasonably identifiable individual) before it is shared, sold, published or used to train a model: the data, the release environment, re-identification risks, controls and the decision.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia
- AI level: Yellow. AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at: 2026-10-18
- Status: Maintained. Checked on 2026-10-18 against the 2 authorities it cites, for Australia.

## When to use it

Use before an organisation or agency shares a dataset with a partner, researcher or vendor, publishes open data, or uses data for analytics or AI training on the basis that it is not personal information. If the data is still personal information, the APPs apply to the use or disclosure.

## Used for these tasks

- [Assess whether a dataset is de-identified before it is shared or released](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md#A25-Y20261018-9)

## How AI may be used

AI may profile the dataset (fields, rarity of combinations, free text) and list re-identification risk indicators; the privacy officer and the lawyer decide whether individuals are reasonably identifiable in the intended release environment.

**AI may:**

- List fields and classify them as direct identifiers, quasi-identifiers, sensitive attributes or free text
- Count small cells and unique combinations of quasi-identifiers and flag them
- Draft the description of the release environment and controls from the data sharing agreement for checking

**AI must not:**

- Must not decide that the data is de-identified
- Must not attempt to re-identify individuals or link the dataset with outside data except in a controlled test the privacy officer has approved
- Must not be given the identified source data outside an approved environment

**The lawyer checks:**

- Direct identifiers are removed and quasi-identifiers, small cells and free text have been treated
- The assessment considers who will receive the data, what other information they hold or can access, and the controls on them
- The decision and its reasons are recorded, with a review date and a trigger for reassessment if the release environment changes
- If individuals remain reasonably identifiable, the APPs (including APP 6 and, for overseas recipients, APP 8) have been applied to the disclosure

## Authorities

- [Privacy Act 1988 (Cth) s 6(1) definition of de-identified (information no longer about an identifiable individual or an individual who is reasonably identifiable)](https://www.legislation.gov.au/C2004A03712/latest/text)
- [Privacy Act 1988 (Cth) s 6(1) definition of personal information (information or an opinion about an identified individual or an individual who is reasonably identifiable, whether true or not and whether recorded or not)](https://www.legislation.gov.au/C2004A03712/latest/text)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/de-identification-assessment-before-sharing-or-release and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*