Is SDC the same as cybersecurity?

No. It focuses on what released information can reveal, while cybersecurity also addresses system and access threats.

Must SDC make all risk zero?

Practical frameworks generally specify an acceptable protection objective; usefulness and residual risk must be assessed under that framework.

Does one method suit every dataset?

No. Data structure, sensitivity, users, and release patterns matter.

AI Glossary / Statistics and probability / Intermediate

Statistical Disclosure Control (SDC)

Definition

Statistical Disclosure Control, abbreviated SDC, is the set of methods used to reduce the risk that released statistical information reveals protected details about individuals, households, businesses, or other units. Methods commonly restrict detail, suppress selected information, or modify released values. SDC is also called statistical disclosure limitation. In the supplied OECD terminology, its focus is dissemination, while broader statistical data protection covers the full production lifecycle. SDC manages disclosure risk alongside the usefulness of the released information.

What it means

A statistical output can reveal more than its publisher intends. Small counts, dominant contributors, unusual records, and overlapping tables can expose confidential information without displaying a direct identifier. SDC addresses those risks before or during release.

Protection is not a single universal cell-size rule. A method appropriate for a public table may differ from one used for detailed research data in a controlled environment. Decisions should consider who receives the information, what other data are available, which attributes are sensitive, and which analyses the output should still support.

How it works

Specify the release and its protection objective. Assess plausible routes to identification or attribute inference, including combinations with existing outputs. Select methods that address those routes, then evaluate how the protected output differs from the original for intended uses.

Suppression withholds selected values, sometimes requiring additional cells to be hidden so totals cannot reconstruct them. Aggregation or coarsening reduces detail. Rounding changes precision, while perturbation deliberately alters values according to a mechanism. Microdata methods may modify categories or values and must be evaluated against linkage and inference risks.

Check consistency across tables, queries, periods, and revisions. Protection should not be assessed independently for each output when their combination matters. Record decisions, communicate relevant limitations to users, and maintain an appropriate review process. SDC is distinct from protecting storage systems against unauthorized access; both may be required. A formal guarantee such as differential privacy requires a specifically designed mechanism and cannot be inferred from the presence of random noise alone.

Three practical examples

1. A statistical office combines small geographic categories before publishing a table that would otherwise reveal sensitive local information.

2. A business survey uses primary and complementary suppression to prevent a confidential contributor value from being reconstructed from totals.

3. A research service reviews proposed outputs from detailed data and adjusts release detail when a result creates unacceptable disclosure risk.

Think of it this way

Think of editing a group photograph so that a protected detail cannot be recovered. Covering one spot may fail if the same detail appears in a reflection or another photograph. SDC similarly considers the relationships between released pieces of information, not just the appearance of one cell.

Worked example

Consider an original two-by-two count table. The first row contains 2 and 8, with row total 10. The second contains 7 and 13, with row total 20. The column totals are 9 and 21, and the grand total is 30.

Suppose the publisher hides only the value 2. It remains recoverable as 10 - 8 = 2 from the first row, or 9 - 7 = 2 from the first column. Hiding a small cell alone has not achieved the intended protection.

Now suppose the four interior cells are withheld but the row and column totals remain. Let the first cell be a. The other cells must then be 10 - a, 9 - a, and 11 + a. Nonnegative integer counts permit a to take values from 0 through 9. The margins alone no longer determine the first cell exactly.

This illustrates complementary constraints and information loss; it is not a complete suppression recommendation. External knowledge or other published tables could narrow the range, and retaining only margins may remove the association information users need. A real SDC decision must assess the entire release context and compare alternative methods rather than stop at this arithmetic check.

Illustrative case study

In a fictional regional business network, analysts plan a detailed table of employment by location and industry. A simple rule flags small cells for suppression, but a reviewer reconstructs several of them from published margins.

The team reviews the full table system, considers broader categories, and evaluates how each option affects the planned analysis. It documents the chosen treatment and explains which comparisons users can still make. The network retains a record of earlier releases so that future revisions are checked against what is already public, rather than treating each spreadsheet as an isolated decision.

Common misconceptions and mistakes

Do not assume that a suppressed value is protected merely because it is blank. Margins and related tables can determine it. A large count is not automatically safe if it reveals a homogeneous sensitive attribute or a total dominated by one contributor.

Different methods protect against different risks and introduce different distortions. Rounding can affect totals, perturbation can affect small-group comparisons, and aggregation can hide meaningful variation. Removing identifiers from microdata does not eliminate linkage risk. Finally, a low disclosure-risk estimate depends on its assumptions; changing recipients, auxiliary data, or the release schedule can change the assessment.

Business use

SDC allows organizations to release useful statistics while respecting confidentiality commitments. It supports survey publication, benchmarking reports, research access, and data partnerships. Plan protection early enough that the reporting design can change, and assess utility using the actual questions users need to answer. Provide clear metadata about modified, suppressed, or rounded results so users do not interpret protected outputs as exact unaltered observations.

Check your understanding

A row total is 18 and its two cells are 5 and a suppressed value. Can the suppressed count be recovered?

Answer: Yes. It equals 18 - 5 = 13, assuming the row total includes exactly those two cells. Additional protection is needed if that count must remain confidential.

Related terms

Statistical confidentiality
Aggregation
Random perturbation
Statistical Data Protection (SDP)
disclosure risk
complementary suppression
rounding
microdata
statistical data protection

Learn next

Study simple reconstruction through table margins, then compare suppression, coarsening, and perturbation. Learn how output checking changes when multiple tables or repeated queries are available.

Sources

OECD, Glossary of Statistical Terms, Statistical Disclosure Control: https://www.oecd.org/content/dam/oecd/en/publications/reports/2008/09/oecd-glossary-of-statistical-terms_g1gh9ad7/9789264055087-en.pdf

Office for National Statistics, Comparison of post-tabular statistical disclosure control methods: https://www.ons.gov.uk/peoplepopulationandcommunity/populationandmigration/populationestimates/methodologies/comparisonofposttabularstatisticaldisclosurecontrolmethods

The official definition and methods discussion were consulted. The table construction and fictional case are original illustrations, not a release approval or a universal protection rule.

Previous: Statistical disclosure Next: Statistical edit