Does removing names guarantee confidentiality?

No. Indirect identification and attribute inference remain possible.

Can business data require confidentiality?

Yes. The protected statistical unit need not be a person.

Does confidentiality mean no one can analyze detailed data?

Not necessarily. Authorized analysis may occur under suitable controls and purpose restrictions.

AI Glossary / Statistics and probability / Intermediate

Statistical confidentiality

Definition

Statistical confidentiality is the protection of information about individual statistical units against unauthorized disclosure when data are collected, processed, or used to produce statistics. Units may include people, households, or businesses. Protection applies to information obtained directly from respondents and to administrative or other data sources. It includes preventing disclosure through released statistics, not merely keeping names out of a dataset. The exact duties and permitted uses depend on the applicable legal and institutional setting.

What it means

Statistics are intended to describe populations or groups, but the records used to create them can contain sensitive information about particular units. Confidentiality concerns the obligation and arrangements that protect that information throughout its use.

Removing direct identifiers is useful but insufficient on its own. A rare combination of attributes, a recognizable business, or a set of overlapping totals can reveal information even when no name appears. Confidentiality therefore requires attention to what a recipient can learn by combining a release with other available knowledge, as well as to who can access the underlying records.

How it works

Define the information that needs protection, the legitimate statistical purpose, authorized users, and the intended outputs. Collect only what the purpose requires, establish appropriate access and handling arrangements, and retain a record of responsibilities and decisions.

Before releasing results, assess whether individuals or other units could be identified or sensitive attributes inferred. Consider small groups, unusual records, dominant contributors, linked information, and earlier releases. Depending on the context, safeguards can include aggregation, suppression, restricted access, or appropriately designed perturbation. These methods have different effects on usefulness and must be selected for the particular risk.

Review the release program as a whole. A table that appears acceptable in isolation may disclose information when combined with another table. Document the remaining risks and the reasons for the chosen safeguards. Statistical confidentiality is supported by technical, organizational, and methodological measures; it is not established by one label such as anonymous or confidential.

Three practical examples

1. A business survey publishes industry summaries while protecting the sales reported by individual participating firms.

2. An employee survey limits access to responses and reviews subgroup reports so that a small team's answers are not attributed to identifiable people.

3. A research data service provides controlled access to detailed records and checks proposed outputs before they leave the secure environment.

Think of it this way

Think of a promise to describe a choir without exposing what one singer said privately. Omitting the singer's name is not enough if the description points unmistakably to that person. The promise concerns what can be learned, not just which labels have been removed.

Worked example

Consider an original fictional business table reporting total revenue for three firms as 900 units. The table separately reports firm A's revenue as 300 and firm B's as 350, while suppressing firm C's value as confidential.

Despite the blank cell, C's revenue is exactly recoverable: 900 - 300 - 350 = 250 units. Suppressing only the sensitive cell has not protected it. The released total and the other components jointly determine the missing value.

Suppose the publisher also suppresses B's value. From this table alone, a reader now knows B + C = 600, rather than C exactly. That change removes the simple exact reconstruction within this table, but it does not prove confidentiality: a separate public report giving B = 350 would again reveal C = 250. Other constraints could also narrow the possibilities.

The arithmetic illustrates why complementary information and external knowledge matter. It is not a complete suppression algorithm or a declaration that any particular combination of hidden cells is safe. The appropriate protection depends on the actual release environment and the information that must remain confidential.

Illustrative case study

In a fictional professional association, members agree to contribute commercial data for a sector report. The association removes business names and prepares detailed regional tables.

A reviewer notices that one region contains a single widely known provider and that several overlapping tables can isolate another member. The publication team changes the level of detail and reviews related releases together. It also clarifies who can access the original submissions. The report remains useful for broad trends while avoiding an unsupported claim that name removal alone fulfills the confidentiality commitment.

Common misconceptions and mistakes

Confidentiality is not identical to privacy, security, or anonymity. Privacy concerns can include whether information should be collected or used at all. Security protects systems and access. Confidentiality concerns restrictions on disclosure and use of entrusted information; these concepts overlap but do not replace each other.

Do not assume that aggregation always prevents disclosure, that a fixed minimum cell count is universally sufficient, or that suppression cannot be reversed. Large totals may still be dominated by one contributor. A technically protected release can also conflict with its permitted purpose or contractual commitments. Conversely, confidentiality does not necessarily require making all statistical information inaccessible; controlled access and carefully designed outputs can support legitimate use.

Business use

Statistical confidentiality helps sustain trust in surveys, research, and data partnerships. Organizations should explain the purpose of collection, permitted uses, access arrangements, and release safeguards in terms people can understand. Allocate responsibility for checking outputs and for responding when new information changes the disclosure risk. Evaluate usefulness and protection together, while obtaining appropriate advice for the governing legal and institutional requirements.

Check your understanding

A published total is 500 and the only two published components are 180 and a suppressed value. What can a reader infer?

Answer: If those are the only components, the suppressed value is 500 - 180 = 320. The blank cell alone does not prevent disclosure.

Related terms

Statistical disclosure
Privacy
disclosure control
data protection
confidentiality agreement
indirect identifier
complementary suppression
secure research access

Learn next

Learn how identity and attribute disclosure differ, then study risks from linked releases and dominant contributors. Compare output protection with secure access to underlying data.

Sources

OECD, Glossary of Statistical Terms, Statistical confidentiality: https://www.oecd.org/content/dam/oecd/en/publications/reports/2008/09/oecd-glossary-of-statistical-terms_g1gh9ad7/9789264055087-en.pdf

Office for National Statistics, Statistical disclosure control policy: https://www.ons.gov.uk/aboutus/transparencyandgovernance/datastrategy/datapolicies/statisticaldisclosurecontrol

The official definition and policy were consulted for general concepts. This is an educational explanation, not jurisdiction-specific legal advice. Numerical examples and the fictional case are original.

Previous: Statistical classification Next: Statistical control