Can several PETs be combined?

Yes. Complementary techniques can address different boundaries, but the combined implementation needs assessment.

Does a PET always reduce accuracy?

Not necessarily. Some primarily change computation cost or trust assumptions, while others introduce a privacy - utility tradeoff.

Is ordinary encryption a complete AI privacy solution?

It is important for specified access threats but does not by itself address every inference or inappropriate-use risk.

AI Glossary / Governance, ethics and safety / Intermediate

Privacy-enhancing technology

Definition

A privacy-enhancing technology, or PET, is a technical method that helps reduce privacy risks by limiting data exposure, enabling protected computation or reducing what can be inferred from released results. Different PETs protect different parts of an information-processing workflow.

What it means

The category includes techniques with very different purposes. Some help compute across data held by separate parties without revealing each party's raw inputs. Others protect information while it is processed or limit what a published result reveals about individuals.

A PET is therefore not a single product feature or a universal privacy guarantee. The useful question is what it protects in the proposed system and what remains visible. A method that hides inputs during computation may still produce an output containing sensitive information.

Using a PET does not automatically make data anonymous or establish that the underlying purpose is appropriate. Many applications still involve personal data and require suitable governance. Technology can implement parts of a privacy strategy, but it cannot independently decide which uses should occur or which tradeoffs are acceptable.

How it works

Define the task, recipients and information to protect before choosing a technique. Distinguish input privacy, concerning what participants or processors can learn during computation, from output privacy, concerning what recipients can infer from the result.

Secure multiparty computation can support joint calculations under specified assumptions about participants and their behavior. Homomorphic encryption enables selected computations on encrypted data, with important questions about key control and the eventual decrypted result. Differential privacy instead provides a formal output-distribution guarantee under a defined privacy unit and parameters. These mechanisms address different boundaries and can sometimes be combined.

Assess implementation maturity, performance and operational requirements. Key handling, trusted components, permitted collusion and repeated releases may affect the protection. Federated learning keeps raw training data distributed in a common architecture, but its updates and model outputs still require privacy assessment. Synthetic data likewise needs evaluation rather than an assumption that generated records cannot reveal information about the source.

Three practical examples

Two organizations explore a protected joint calculation that avoids exchanging their raw records, while separately assessing what the final result reveals.
An analytics team evaluates differential privacy for a public statistical release and documents its privacy parameters and accounting.
A research project tests synthetic data for usefulness and disclosure risk before sharing it with a wider development team.

Think of it this way

Think of different protective tools for different stages of a delivery. A sealed container protects contents during transport, while a rule about what the recipient may receive addresses the final disclosure. One does not automatically provide the other.

The analogy is limited because digital outputs can reveal facts by inference, even without containing an obvious copy. PET selection must consider information learned, not only physical-style access.

Worked example

Protected computation can still reveal a private value

In an invented example, two parties use a secure protocol to calculate the exact sum of their private values. Party A contributes 12 and Party B contributes 7. The released total is 19.

If A knows its own value and receives the total, it can calculate B's value as 19 − 12 = 7. The computation may have protected intermediate messages as designed, yet the agreed output reveals B's input in this two-party setting.

This is not necessarily a flaw in the cryptographic protocol. It is a limitation of the chosen output and threat model. The design must consider whether that disclosure is acceptable or whether a different query, group size, release rule or additional protection is needed. No single adjustment is universally sufficient.

Illustrative case study

Fictional case: Larch Analytics considers a partner's claim that its collaborative AI platform is private because raw data never leave each organization. Reviewers ask what is exchanged instead, who can inspect the updates and what the shared model can reveal.

The project team documents the distributed-training architecture and evaluates additional protections for the relevant information flows. It also checks access to local logs and the final outputs. Its description becomes specific about the boundaries protected and the remaining assumptions.

The case illustrates why architecture labels are not complete privacy evidence. It does not imply that distributed learning has no value or that every deployment needs the same combination of techniques.

Common misconceptions and mistakes

All PETs anonymize data. Many protect processing or access while the information remains personal.
Encrypted computation guarantees a harmless result. The decrypted output can still disclose sensitive information.
Federated or synthetic automatically means private. Those approaches require their own threat assessment and evidence.

Business use

Businesses can use a comparison sheet that links each proposed PET to a concrete threat, required assumptions, performance cost and residual risk. Ask suppliers for the exact guarantee, implementation evidence and operational responsibilities, including key management or privacy accounting where relevant.

Pilot the complete workflow rather than only the mathematical component. Check whether data minimization could simplify the problem before adding a complex technique. Ensure that organisational controls and user-facing explanations match the design. Jurisdiction-specific obligations remain separate from the technical assessment and should be evaluated in the applicable context.

Check your understanding

A secure calculation reveals an exact total for two participants, each of whom knows their own input. Can either infer the other's input?

Answer: Yes, by subtracting their own value. Protecting the computation does not remove information logically revealed by the output.

Related terms

Differential privacy
Federated learning
Synthetic data
Privacy-by-design
Secure multiparty computation
homomorphic encryption

Learn next

Read input privacy and differential privacy. For one proposed PET, draw the data flow and mark what every participant learns before, during and after the computation.

Differential privacy

Sources

UK ICO, How can PETs help with data protection compliance?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/privacy-enhancing-technologies/how-can-pets-help-with-data-protection-compliance/. Relevant returned guidance covers input/output distinctions and limitations; it notes ongoing legislative review. NIST SP 800-226: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-226.pdf. The two-party sum and fictional review are original illustrations, not implementation or legal assurances.

Previous: Privacy-by-design Next: Privacy funnel