ANONYMISED DATA FROM AN ISO 27000 PERSPECTIVE Technical Methods, Standards, Re-Identification Risk and KVKK Compliance Review Article Keywords: Anonymisation • ISO 27559 • k-Anonymity • Pseudonymisation • KVKK • GDPR • Re-Identification ABSTRACT As the data economy accelerates, the balance between protecting personal data and, at the same time, keeping valuable data sets usable for research, statistics and artificial intelligence is becoming an increasingly strategic issue. Anonymisation constitutes the principal technical mechanism for striking that balance: permanently severing the individual link from personal data so as to remove it from personal data status and bring KVKK/GDPR obligations to an end. Yet the technical reality of the concept of 'anonymous data' is far more complex than its legal definition: with re-identification attacks, combined data sets and the strengthening of artificial intelligence models, even theoretically anonymised data can regain personal data status. This review article examines comprehensively controls A.8.11 and A.8.12 within ISO/IEC 27001:2022, the ISO/IEC 20889:2018 terminology standard, the ISO/IEC 27559:2022 de-identification framework, the ISO/IEC 29100:2024 privacy framework, core technical methods such as k-anonymity and differential privacy, re-identification risk assessment methodology, the KVKK's approach to anonymisation and the practical implementation dimensions in Türkiye. Keywords: anonymisation, pseudonymisation, k-anonymity, l-diversity, t-closeness, differential privacy, ISO/IEC 27559, ISO/IEC 20889, ISO/IEC 29100, re-identification, data masking, KVKK, GDPR, information security ABSTRACT With the acceleration of the data economy, the balance between protecting personal data and making valuable data sets available for research, statistics, and artificial intelligence purposes is increasingly becoming a strategic issue. Anonymization is the primary technical mechanism for achieving this balance: permanently severing the individual link from personal data to remove it from personal data status and end KVKK/GDPR obligations. However, the technical reality of the concept of 'anonymous data' is far more complex than its legal definition: With re-identification attacks, combined datasets, and strengthened AI models, theoretically anonymized data can reacquire personal data status. This review article comprehensively examines controls A.8.11 and A.8.12 within ISO/IEC 27001:2022, the ISO/IEC 20889:2018 terminology standard, the ISO/IEC 27559:2022 de-identification framework, the ISO/IEC 29100:2024 privacy framework, core technical methods such as k-anonymity and differential privacy, re-identification risk assessment methodology, KVKK's anonymization approach, and practical implementation dimensions in Turkey. Keywords: anonymization, pseudonymization, k-anonymity, l-diversity, tcloseness, differential privacy, ISO 27559, ISO 20889, ISO 29100, reidentification, data masking, KVKK, GDPR, information security 1. Introduction Data is described as the most valuable resource of the 21st century; but realising that value depends largely on data being freely shareable and analysable. At the same time the protection of personal data is under the strong guarantee of both international human rights law and national legislation. The most fundamental technical route to resolving the tension between these two requirements is anonymisation: severing data from its link to individual identity so as both to place it outside the scope of personal data protection and to preserve its analytical value. Control A.8.11 (Data Masking) in Annex A of ISO/IEC 27001:2022 formally brought anonymisation and pseudonymisation techniques into the ISMS control set. This confirms at international level that anonymisation is now an inseparable component not only of data protection law but of information security management. Within the ISO family, ISO/IEC 27559, published in 2022, offers the first comprehensive framework standard for data de-identification.
Even so, the deep gulf between the legal and the technical meaning of anonymisation is becoming an increasingly critical problem. The exposure of the Netflix Prize data set, the de-anonymisation of AOL search histories and health data re-identification cases have shown concretely that the label 'anonymised' is not a genuine guarantee. The rise of artificial intelligence increases this risk further: large language models and machine learning systems can synthesise apparently unrelated information from several anonymised sources to construct individual profiles (APPA, 2025).
The aim of this article is to address systematically, from the perspective of the ISO 27000 family, the technical methods, standards, risk assessment methodology and legal dimensions of anonymisation. The article is structured under the headings of conceptual framework, the ISO family of standards, technical methods, re-identification risks, ISMS integration, the KVKK and GDPR context, sectoral applications and the new threats created by artificial intelligence. 2. Conceptual Framework: Basic Definitions and Distinctions 2.1 The Difference Between Anonymisation, Pseudonymisation and Data Masking Although the concepts of anonymisation, pseudonymisation and data masking are often used interchangeably in practice, they carry fundamental technical and legal differences. Understanding these differences correctly is of decisive importance both for technical design and for legal compliance.
Anonymisation: rendering personal data such that it can in no way be associated with an identified or identifiable natural person, including through the use of additional information. According to the KVKK's (undated) definition, it is 'the rendering of personal data such that it can in no way be associated with an identified or identifiable natural person, even if matched with other data.' Following successful anonymisation, data loses its status as personal data and falls outside the scope of the KVKK/GDPR.
Pseudonymisation: the processing of personal data such that it can no longer be attributed to a specific data subject without the use of additional information. As Polymer HQ (2024) explains, it is 'the replacement of information that could be used for identification purposes with a pseudonym such that the person cannot be identified without additional information.' The critical difference is this: pseudonymisation is reversible. When access to the additional information (the re-identification key) is obtained, the data becomes personal data again. For this reason pseudonymisation still counts as processing of personal data under the GDPR and the KVKK; it has value only as a security measure.
Data Masking: the concealment merely of the appearance of sensitive data. In SPIDYA's (2026) example: showing the first and last digits of a credit card number and starring out the middle is an example of masking. Although this approach is sufficient in certain scenarios, in most cases it is possible to return to the original state of the data. Masking does not remove data from the scope of the KVKK; only full anonymisation takes data outside the law (Nesil Teknoloji, 2026).
2.2 The Concepts of Quasi-Identifier and Identifier At the centre of anonymisation design lies a distinction between three data types. Direct identifiers are data items directly identifying an individual on their own: name, surname, national identity number, passport number, email address, telephone number. Removing or transforming these items is the mandatory first step of anonymisation. Quasi-identifiers are items that are not identifiers on their own but that reveal an individual's identity when combined with other data. Age, gender, postcode, occupation and disease type are the classic examples of this category. Sweeney's (1997) striking research showed that the combination of postcode, gender and date of birth uniquely identifies eighty per cent of the US population. This finding demonstrates the quasi-identifier danger concretely and explains why removing direct identifiers is not sufficient on its own (APPA, 2025).
Sensitive attributes are pieces of information that require protection but are not quasi-identifiers: disease type, political opinion, criminal record, religious belief. The confidentiality of these items requires the anonymisation model to be protected in particular against attribute disclosure attacks. The limitation of k-Anonymity appears precisely at this point: while k-anonymity prevents identity disclosure, it cannot prevent attribute disclosure. 3. The ISO 27000 Family: Standards Relating to Anonymisation Figure 1. The ISO 27000 Family: A Map of Standards Relating to Anonymisation and Privacy 3.1 ISO/IEC 27001:2022 — The A.8.11 Data Masking Control The A.8.11 Data Masking control added to Annex A of ISO/IEC 27001:2022 in the 2022 revision made anonymisation a formal element of the ISMS control set. As Polymer HQ (2024) recounts, under this control it is recommended that 'you document data masking rules and access rights in the Information Classification Policy, the Access Control Policy and the Secure Development Policy according to the confidentiality level of your data and regulatory requirements.'
The most common techniques within the scope of the control are: Pseudonymisation — replacing information that could be used for identification purposes with a pseudonym. Anonymisation — rendering data incapable of identifying a person. Encryption — key-based protection accompanied by access control. Obfuscation — deliberately rendering data difficult to understand. Among these techniques, anonymisation and pseudonymisation are the most critical for GDPR and KVKK compliance (Polymer HQ, 2024).
3.2 ISO/IEC 20889:2018 — Terminology and Technical Classification ISO/IEC 20889:2018 is the terminology standard of the data de-identification field and forms the basis of ISO/IEC 27559:2022. As k2view (2025) recounts, the standard 'defines data anonymisation techniques and processes, helping organisations enable data analysis and sharing while protecting individual privacy.' The standard classifies anonymisation techniques in five main categories: Suppression, Generalisation, Randomisation, Pseudonymisation and Synthetic Data Generation. This classification offers organisations a systematic framework for selecting the right combination of techniques according to their data protection purpose and their data use requirement.
3.3 ISO/IEC 27559:2022 — The De-Identification Framework ISO/IEC 27559:2022, under the title 'Privacy Enhancing Data De-Identification Framework', constitutes the principal framework standard of the anonymisation field. According to the assessment of the IAPP (2026), this standard is designed 'to identify various risks in the de-identification process and to mitigate them throughout the life cycle of the de-identified data.'
The standard is the product of a five-year period of work. As the IAPP (2026) recounts, it covers 'a period of work reviewing guidance from around the world, and the basis and terminology of the ISO/IEC 20889:2018 standard.' The standard defines four basic use scenarios with the roles of data custodian and data recipient: internal use (within the same organisation), external sharing (in a controlled environment), open data publication (publicly available) and research sharing (with contracted third parties). APPA's (2025) critical warning is particularly striking: 'ISO/IEC 27559 was written on the assumption of a strict binary distinction between information subject to privacy laws (personal information) and information outside scope (anonymised information). While first-generation privacy laws worked on that assumption, more modern privacy laws tend towards a three-way distinction between personal, "de-identified" and anonymised information.' This means that information deemed 'anonymised' under ISO 27559 may still count as pseudonymised under local legislation.
3.4 ISO/IEC 29100:2024 — The Privacy Framework ISO/IEC 29100:2024 defines a privacy framework applicable to any system or service containing personal data (PII). As the ANSI Blog (2025) recounts, the standard offers a structure 'emphasising the need for the removal of PII and providing guidance on carrying this out in a way that prevents the re-identification of anonymised data.'
The standard defines privacy principles compatible with many privacy regimes including the GDPR. These principles include Purpose Limitation, Data Minimisation, Accuracy, Storage Limitation and Privacy by Design. Used in an integrated way with ISO/IEC 27701, it can form the technical infrastructure of KVKK/GDPR compliance for organisations holding ISO 27001 certification.
4. Basic Anonymisation Techniques Figure 2. Classification of Anonymisation Techniques Under ISO/IEC 20889:2018 4.1 Suppression Suppression is the removal of particular fields or values in the data. The deletion of direct identifiers (name, national identity number, email) from the data set is the most basic example of suppression. A more advanced form, record suppression, is the complete removal from the data set of records meeting particular criteria — for example individuals diagnosed with a rare disease. This method is applied where the data of small groups is by its nature identifiable (ISO/IEC 20889:2018). The basic limitation of suppression is that it reduces the analytical value of the data. When record suppression is applied, statistical validity for particular subgroups of the data set may be jeopardised. Suppression should therefore be regarded not as an anonymisation method on its own but as a complementary layer combined with other techniques. 4.2 Generalisation Generalisation is the replacement of specific values with broader categories. Converting an age value (25) into a range (20-30), removing the final digits of a postcode (34070 → 3407*) and raising a disease diagnosis from a lower to a higher category are common examples of this technique. As Nesil Teknoloji (2026) recounts, 'generalising values (Age: a 20-30 range instead of Age: 25)' is among the KVKK-compliant anonymisation methods.
Generalisation constitutes the basic implementation mechanism of the k-anonymity model. There is a trade-off between the degree of generalisation (granularity) and anonymisation quality: higher generalisation provides stronger anonymity while reducing the analytical precision of the data. Managing this trade-off is one of the most critical engineering challenges of anonymisation design.
4.3 Randomisation Randomisation techniques make individual identification harder by adding statistical noise to the data or shuffling values. The principal sub-methods are: Noise Addition: small random deviations are added to numerical values. For example a random value in the range of ±500 TL is added to a person's income information, concealing the true value while preserving the statistical distribution of the data set. Differential privacy represents the mathematically strengthened form of this approach.
Permutation: the random exchange of sensitive attribute values between records. For example the values in the salary column of a data set are matched randomly with other individuals; the salary distribution is thus preserved while the identity–value link is broken. Data Swapping: the exchange of particular attribute values between matched individuals. Widely used in geographical data anonymisation, this technique conceals individual values while preserving statistical marginal distributions. 4.4 Pseudonymisation Pseudonymisation is the replacement of direct identifiers with consistent but unidentifiable codes. One-way hash functions such as SHA-256, symbolic pseudonyms or encryption-based tokens are the tools of this technique. Deterministic pseudonymisation — the same input always maps to the same pseudonym — allows individuals to be tracked across different data sets, and for that reason finds widespread use in research databases.
The basic difference between pseudonymisation and anonymisation is this: it is possible to reunite the data with the original through a key or mapping table. This structural feature is stated explicitly in Article 4(5) of the GDPR: pseudonymised data remains personal data because it can be attributed to a natural person using additional information. In Türkiye too, pseudonymisation is not treated as equivalent to anonymisation under the KVKK; the controller's obligations continue (Ersan Çetin, 2025).
4.5 Synthetic Data Generation Synthetic data is an artificial data set preserving the statistical properties of primary data obtained from real individuals but carrying no direct link to real people. Generative Adversarial Networks (GAN), Variational Autoencoders (VAE) and statistical simulation models are the principal generation methods in this field.
The digital health data anonymisation framework published by Naef et al. (2024) in Cureus analyses the applicability of synthetic data for both large and small-scale data sets. The basic advantage of synthetic data is that no real record exists that could be used for a re-identification attack; its basic limitation is that a level of fidelity not identical to real data can lead to potential bias in model training or in critical decision support systems.
Table 1. A Comparative Assessment of Anonymisation Techniques Technique Reversible Data Loss Analytical Value Most Suitable Use Suppression No High Reduced Removal of direct identifiers Generalisation No Moderate Preserved (partly) k-Anonymity implementation, data sharing Noise Addition No Low Largely preserved Statistical publications, AI training Pseudonymisation Yes (with key) None Fully preserved Research, clinical follow-up, logging Synthetic Data No None (artificial) High (model dependent) AI/ML training, test environments Differential Privacy No Low Largely preserved Big data statistics, AI Note. Compiled on the basis of ISO/IEC 20889:2018; Polymer HQ (2024); Censinet (2026); Naef et al. (2024).
5. k-Anonymity, l-Diversity, t-Closeness and Differential Privacy Figure 3. k-Anonymity: A Conceptual Example — Anonymisation with k=3 5.1 k-Anonymity: The Basic Model and Its Limitations k-Anonymity, developed by Latanya Sweeney in 1998, is still the most widely used anonymisation model today. Its basic principle is this: in a data set every record must be identical to at least (k-1) other records in terms of quasi-identifier values. When that condition is met, directly identifying an individual requires choosing among at least k candidate records, which reduces the probability of re-identification to at most 1/k. As Censinet (2026) recounts, k-Anonymity is 'increasingly referenced by international standards such as ISO/IEC 27559 and ISO/IEC 20889' and can be used for compliance with the GDPR's definition of non-personal data. Even so, k-Anonymity has two structural limitations. The Homogeneity Attack: in a group where k people share the same quasi-identifier values, if all individuals carry the same sensitive attribute (for example if all have the same disease), the attacker can infer the sensitive attribute directly from the quasi-identifier information. This leads to attribute disclosure even where identity is concealed.
The Background Knowledge Attack: where the attacker has contextual information about the target individual, k-anonymity protection collapses. For example an attacker combining the knowledge 'I know Ahmet is in this data set' with 'everyone in this group is a cancer patient' reaches the sensitive attribute without any direct identity disclosure. 5.2 l-Diversity: A Response to the Homogeneity Attack l-Diversity was developed by Machanavajjhala et al. (2007) to close the homogeneity attack gap in k-anonymity. The model adds the following condition: each quasi-identifier group must contain at least l 'well represented' distinct values for the sensitive attribute. In practice this means that not all individuals in a group can have the same disease, political opinion or income level.
l-Diversity is not free of limitation either. The most obvious problem arises where the overall background distribution of the sensitive attribute in the data set is skewed. For example, in a context where a particular disease is known to occur in one per cent of the population, even a twenty per cent rate in a hospital data set, combined with background knowledge, lays the ground for attribute inference. This problem led to the t-closeness model. 5.3 t-Closeness: A Distribution Guarantee t-Closeness, developed by Li et al. (2007), requires that the distribution of the sensitive attribute in each quasi-identifier group may differ from the overall distribution in the whole data set by at most a distance t. The work of Domingo-Ferrer and Soria-Comas (2015) established mathematically the strong relationship between t-closeness and ε-differential privacy: expressible as 'requires ε-differential privacy but does not require k-anonymity', this relationship shows that the two models are complementary. 5.4 Differential Privacy Differential privacy (DP), developed by Dwork (2006), is today accepted as the mathematically strongest privacy guarantee. Its basic intuition is this: whether a particular individual is included in the data set should change the statistical output only by a small amount controlled by the parameter ε. As a result no one can reliably infer, by examining the results, whether a particular individual is in the data set.
As Censinet (2026) recounts, differential privacy 'adds noise to data that mathematically limits re-identification risks.' Large technology companies such as Apple, Google and Meta apply DP in practice when collecting product statistics. Apple has collected usage statistics with DP since iOS 14; Google's RAPPOR system also applies DP-based client-side privacy protection. The US Census Bureau adopted DP methodology for publishing population statistics in the 2020 census. DP's most critical advantage is that, unlike k-anonymity, it offers a mathematical guarantee against contextual attacks: the upper bound of information leakage controlled by the parameter ε is determined independently of the background knowledge the attacker possesses. DP's difficulty in practice is setting the ε privacy budget correctly: too small an ε leads to excessive noise, while too large an ε leads to an inadequate privacy guarantee. 6. Re-Identification Risk Figure 4. The Re-Identification Risk Matrix: Likelihood × Impact (ISO/IEC 27559:2022 Framework) 6.1 Historical Re-Identification Cases Cases in which theoretically anonymised data sets have been re-identified prove that this threat corresponds to a concrete reality.
Netflix Prize (2007): Netflix anonymised and published the rating data of 500,000 of its subscribers in order to develop a film recommendation algorithm. Researchers Narayanan and Shmatikov cross-compared the Netflix data with IMDb's public reviews and re-identified a significant proportion of users. This case has become a critical reference point showing how dramatically quasi-identifiers are strengthened when they can be combined from different sources.
AOL Search History (2006): AOL published the search histories of 650,000 users for research purposes. Usernames had been removed and only numerical IDs used. New York Times journalists analysed search content and geographical references and re-identified cases such as users 4417749 and 927. This case permanently changed the agenda of information privacy law by showing how misleading the assumption 'no name means unidentifiable' is.
6.2 The ISO/IEC 27559 Risk Assessment Methodology ISO/IEC 27559:2022 offers a five-factor framework for assessing re-identification risk systematically: Motivation — how strong is a potential attacker's motivation to re-identify? Means — what additional data sources and computing capacity can the attacker access? Opportunity — how is the data published, and who can access it? Data sensitivity — what degree of harm would arise if re-identification were successful? Scope — how many people could be affected? (IAPP, 2026).
Assessing these five factors makes it possible to estimate systematically the two dimensions of re-identification risk — likelihood and impact. The critical point for risk management is that this assessment must be renewed periodically, in parallel with changes in publication conditions and the development of new attack techniques, rather than being carried out once. 6.3 Linkage Attacks and the Artificial Intelligence Threat Linkage attacks are the category of attack in which an attacker re-identifies individuals by combining multiple anonymised data sets with external information. There are two basic forms of such attacks: record linkage — establishing that records in two different data sets belong to the same individual; and attribute linkage — inferring a sensitive attribute belonging to an individual without identification at record level. The effect of artificial intelligence and big data technologies in this field is transforming the traditional re-identification threat qualitatively. As APPA (2025) warns: 'ISO/IEC 27559 operates with the strict binary distinction of first-generation privacy laws; but modern privacy laws tend towards a more flexible three-way distinction. That difference means that data deemed anonymised under ISO 27559 may still count as pseudonymised under local legislation.' In the context of large language model (LLM) training data this risk becomes particularly critical: as Nesil Teknoloji (2026) observes, 'data entered into artificial intelligence prompts may count as a data breach if it has not been anonymised.' This warning makes concrete why data masking and anonymisation controls within the ISMS carry strategic priority as AI platforms spread through organisations. 7. Integration into the ISO 27001:2022 ISMS: Practical Implementation 7.1 Implementing Control A.8.11 For the effective implementation of the A.8.11 Data Masking control within the ISMS framework, Polymer HQ's (2024) recommendation is: 'It is recommended that you document data masking rules and access rights in the Information Classification Policy, the Access Control Policy and the Secure Development Policy.' This documentation obligation ensures that anonymisation decisions are taken systematically and auditably. The practical implementation steps may be listed as follows: classifying whether the information assets in the asset inventory contain personal data. Determining the re-identification risk level for each asset. Selecting the appropriate anonymisation or pseudonymisation technique according to risk level. Applying the selected technique and verifying its effectiveness. Relating anonymisation decisions to the Statement of Applicability (SoA). 7.2 Synergy with A.8.12 Data Leakage Prevention (DLP) The A.8.11 Data Masking and A.8.12 Data Leakage Prevention (DLP) controls form complementary layers of defence. While anonymisation removes data from personal data status, DLP prevents the unauthorised data disclosure that could invalidate that decision. The integrated design of these two controls prevents data leakage before anonymisation and restricts access to raw data that could revert to personal data after anonymisation.
7.3 Risk Assessment and Reflection in the SoA The recommended approach for integrating anonymisation decisions into ISMS risk assessment and the Statement of Applicability is as follows: a separate risk entry should be created for every asset in the asset inventory containing personal data. For each entry, re-identification risk should be scored using ISO/IEC 27559's five-factor assessment framework. The anonymisation technique selected and how it reduces the risk should be documented in the risk treatment plan. The SoA should explain whether control A.8.11 is applicable and, if applied, for which assets and techniques it holds.
Table 2. An Anonymisation Decision Matrix in ISMS Risk Assessment Data Type Re-ID Risk Recommended Technique Monitoring Frequency Standard Reference Health data CRITICAL k-anon (k≥5) + DP + Suppression Reassess on every publication ISO 27559 + HIPAA Location data HIGH Generalisation + noise addition Every 3 months ISO 27559:2022 Financial data HIGH Pseudonymisation + DLP Continuous (automated) ISO 27001 A.8.11 Behavioural data MODERATE k-anonymity (k≥3) + masking Every 6 months ISO 20889:2018 Demographic statistics LOW Generalisation + suppression Annually KVKK Guide (2018) AI training data HIGH Differential Privacy or Synthetic Continuous ISO 27559 + GDPR Note. Compiled on the basis of ISO/IEC 27559:2022; Censinet (2026); Polymer HQ (2024); KVKK (undated).
8. Anonymisation in the Turkish Law and GDPR Context 8.1 The KVKK's Definition of Anonymisation and Its Requirements Law No. 6698 on the Protection of Personal Data defines anonymisation as follows: 'the rendering of personal data such that it can in no way be associated with an identified or identifiable natural person, even if matched with other data' (KVKK, undated). Although this definition coincides with the GDPR, the phrase 'even if matched with other data' explicitly requires linkage attacks to be taken into account, and therefore establishes that methods removing direct identifiers alone are insufficient.
The KVKK's Guide on the Deletion, Destruction or Anonymisation of Personal Data addresses comprehensively the technical and administrative measures organisations must apply in the anonymisation process. As Ersan Çetin (2025) recounts, the principal anonymisation techniques within that guide are: value generalisation, masking, aggregation and k-anonymity. The importance of the guide stems from its adoption of a risk-based approach requiring the selection of the technique appropriate to the situation rather than a hierarchical ranking among these techniques.
The legal consequence of anonymisation is clear: the moment data becomes anonymous it loses its character as personal data and the provisions of the KVKK — the duty to inform, explicit consent, retention periods — cease to apply (Nesil Teknoloji, 2026). The statistics published by TÜİK are the most natural example of this practice. This legal transition is extremely valuable in enabling data to be reused and shared; but the technical validity of that transition must be constructed with a robustness that does not conflict with legal certainty. 8.2 Developments in the GDPR and EU Law Recital 26 of the GDPR states explicitly that anonymous information falls outside the scope of the GDPR. Even so, the EU Article 29 Working Party (WP29) and its successor the EDPB set the standard of anonymity extremely high. WP29 Opinion 05/2014 stresses that k-anonymity alone may not be sufficient as a guarantee of anonymity within the meaning of the GDPR, because it remains fragile in the face of linkage attacks.
The EU Artificial Intelligence Act takes the anonymisation standard to a new dimension in the context of AI systems. The requirement that training data sets used in high-risk AI systems contain no personal data, or that any personal data be sufficiently anonymised, makes the integrated application of ISO 27559 with the A.8.11 ISMS control unavoidable. As 1Password (2024) recounts, the ISO 27000 series 'was prepared before the GDPR came into force, but the comprehensive legislation caused international standards for information security management systems to be newly valued.' 8.3 The Place of Pseudonymisation in the KVKK and the GDPR In both regimes pseudonymisation is sharply distinguished from anonymisation. Article 4(5) of the GDPR provides that pseudonymised data remains personal data because it 'can be attributed to a specific natural person using additional information.' In Turkish law too, the fact that the KVKK's definition of anonymisation contains a condition of irreversibility means that pseudonymisation cannot meet that condition. Even so, pseudonymisation is recognised in both regimes as a security measure. Article 32 of the GDPR expressly lists pseudonymisation among the technical measures that may be taken to ensure an appropriate level of security. That provision positions pseudonymisation not as an alternative to anonymisation but as a complementary layer of protection increasing data security where anonymisation is not carried out. 9. Sectoral Applications and Example Scenarios 9.1 The Health Sector Health data constitutes both the most critical and the most difficult area of application for anonymisation. Patient records carry an extremely high re-identification risk at the intersection of demographic information, diagnosis codes, drug prescriptions and genetic data. The practical anonymisation framework developed by Naef et al. (2024) for digital health applications offers one of the most comprehensive sectoral guides in the literature. The prominent approach in health data anonymisation is a combination of direct identifier suppression (removal of name, national identity number, insurance number) with k-anonymity generalisation (conversion into age ranges, truncation of postcodes). Particularly where rare diseases are concerned this combination may not be sufficient, and additional suppression or differential privacy noise may be required. As Censinet (2026) recounts, these techniques can be applied 'in a manner consistent with HIPAA de-identification standards and GDPR-focused anonymisation rules.'
9.2 The Finance Sector The need for anonymisation in the finance sector arises from several basic use scenarios: sharing transaction data for academic research, sharing anonymised transaction histories with third parties to develop fraud detection algorithms, and the requirement to conceal individuals in regulatory reporting. The re-identification risk of financial data arises from transaction amounts and timestamps functioning as quasi-identifiers. As ODYA (2026) recounts: 'Anonymisation is critical for creating data processes compliant with the KVKK, the GDPR and similar regulations. A data anonymisation tool facilitates that compliance.' The recommended approach for financial institutions is a combination of rule-based pseudonymisation (customer ID tokenisation) with statistical aggregation.
9.3 The Artificial Intelligence and Big Data Context The training of machine learning models constitutes a new and critical area of application for anonymisation. Traditional anonymisation approaches cannot fully address the privacy threats arising when models are trained on large data sets. Deep learning models in particular can 'memorise' training data, and that memorisation can allow individual data to be partly recovered when the model is accessed by querying — an attack type known as a 'model inversion attack'. Differential Privacy stands out as the mathematical countermeasure to this threat. Models trained with DP learn the general distribution rather than individual training patterns, so that the information gain from model inversion attacks is bounded by the parameter ε. The adoption of DP in production systems by Apple, Google and Meta proves that this approach is applicable not only academically but at enterprise scale. 10. Challenges, Open Problems and Recommendations 10.1 The Utility–Privacy Trade-Off The most fundamental tension in anonymisation is the inverse relationship between privacy protection and the analytical utility of data. Stronger anonymisation means greater information loss, which can jeopardise the statistical validity and model accuracy of the data. Optimising this trade-off requires both technical and corporate governance decisions. ISO/IEC 27559's approach resolves the trade-off with a focus on use case: what level of privacy is sufficient for which purpose of use? While k=3 may suffice for a general statistical publication, k≥100 or differential privacy may be essential for genetic research. The answer to that question must be given at the level not of technique but of ethics and institutional policy. 10.2 The Lack of Methodological Standardisation The most critical problem with existing anonymisation practice is the inadequacy of methodological standardisation. According to the finding of Naef et al. (2024), based on a PubMed literature review, studies published on anonymisation use extremely heterogeneous methodologies and most studies fail to explain one or more of the basic security properties defined by ISO 27000. This inconsistency makes comparison of methods and regulatory oversight difficult.
10.3 Policy Recommendations In the light of international practice and the literature, the following policy recommendations are offered: • Adopt ISO 27559: all data de-identification decisions should be documented on the basis of ISO/IEC 27559:2022's five-factor risk assessment framework.
• A single technique is not enough: anonymisation policy should provide for the layered application of more than one technique; removal of direct identifiers alone is definitively inadequate.
• A reassessment cycle: re-identification risk should be reassessed at regular intervals in the light of changes in publication conditions and new attack techniques.
• DP for AI training data: where the use of personal data in machine learning model training is unavoidable, differential privacy should be applied or synthetic data generation preferred.
• Include it within the ISMS: anonymisation processes should be reflected systematically in the ISMS risk assessment and SoA within the framework of ISO 27001 A.8.11.
• Pseudonymisation ≠ Anonymisation: mistaken practices treating pseudonymisation as equivalent to anonymisation should be remedied through corporate KVKK/GDPR compliance policies.
11. Conclusion Anonymisation sits at one of the most critical junctions of the data economy: at the most technical point of resolution of the tension between protecting personal data and realising the scientific and commercial value of that data. Control A.8.11 of ISO/IEC 27001:2022, by adding this technical solution to the formal controls of information security management, has made anonymisation an inseparable component of the ISMS.
ISO/IEC 27559:2022 and ISO/IEC 20889:2018 represent comprehensive standards aiming to fill the methodological gap in this field. Even so, APPA's (2025) warning retains its importance: these standards were written on the assumption of a strict binary distinction (personal / anonymous), whereas modern privacy laws are moving towards a three-way categorisation. This structural gap makes it essential not to create the illusion that compliance with the ISO standards automatically ensures compliance with local legislation. On the technical front, the diversity of models from k-anonymity to differential privacy offers different security guarantees for different use scenarios. Model inversion attacks on artificial intelligence and the data memorisation capacity of large language models are straining traditional anonymisation frameworks. The mathematical guarantee of differential privacy and the rising applicability of synthetic data constitute the most promising technical answers to that challenge.
In the Turkish context the KVKK's definition of anonymisation, with the phrase 'even if matched with other data', sets a strong standard against linkage attacks. For that standard to be met in practice, the ISO/IEC 27559 risk assessment framework must be applied in an integrated way with the KVKK Guide and the A.8.11 ISMS control reflected systematically in institutional policies. Developing this technical-legal compliance capacity remains a priority agenda item for both the private sector and public institutions if Türkiye is to maintain its competitive position in the data economy. References 1Password. (2024, August 30). What you need to know about ISO 27000 standards. https://blog.1password.com/what-you-need-to-know-about-iso-27000-standards ANSI Blog. (2025, November 6). ISO/IEC 27701:2025 — Privacy information management systems. https://blog.ansi.org/ansi/iso-iec-27701-2025-privacy-management-systems/ APPA Technology Working Group. (2025). Guide to getting started with anonymisation. Office of the Australian Information Commissioner.
https://www.pcpd.org.hk/english/resources_centre/publications/files/ appa_anonymisation_guide072025.pdf Censinet. (2026, January 1). Top frameworks for GDPR data de-identification. https://censinet.com/perspectives/top-frameworks-gdpr-data-de-identification Domingo-Ferrer, J., & Soria-Comas, J. (2015). From t-closeness to differential privacy and vice versa in data anonymization. Knowledge-Based Systems, 74, 151–158. https://arxiv.org/pdf/1512.05110 Ersan Çetin, A. (2025, March 15). KVKK: Veri silme ve anonimleştirme. https://ersancetin.av.tr/makaleler/kvkk-silme-anonimlestime/ IAPP. (2026, February 17). A new standard for anonymization. International Association of Privacy Professionals. https://iapp.org/news/a/a-new-standard-for-anonymization ISO/IEC 20889:2018. Privacy enhancing data de-identification terminology and classification of techniques. International Organization for Standardization. ISO/IEC 27001:2022. Information security, cybersecurity and privacy protection — Information security management systems — Requirements. International Organization for Standardization.
ISO/IEC 27559:2022. Information security, cybersecurity and privacy protection — Privacy enhancing data de-identification framework. International Organization for Standardization.
ISO/IEC 29100:2024. Information technology — Security techniques — Privacy framework. International Organization for Standardization.
k2view. (2025, April 24). Complying with today's data anonymization standards. https://www.k2view.com/blog/data-anonymization-standards/ KVKK. (undated). Kişisel verilerin silinmesi, yok edilmesi veya anonim hale getirilmesi. Kişisel Verileri Koruma Kurumu. https://www.kvkk.gov.tr/Icerik/2038 KVKK. (2018). Kişisel verilerin silinmesi, yok edilmesi veya anonim hale getirilmesi rehberi. Kişisel Verileri Koruma Kurumu.
Naef, A., Coduti, E., & Windisch, P. Y. (2024). The anonymous data warehouse: A hands-on framework for anonymizing data from digital health applications. Cureus, 16(4), e57519. https://doi.org/10.7759/cureus.57519 Nesil Teknoloji. (2026, February 6). Kişisel veri nedir? KVKK'ya göre tanım, örnekler ve sınırlar. https://www.nesilteknoloji.com/kisisel-veri-nedir-kvkk-tanim-orneklersinirlar/ ODYA. (2026, February 3). Veri anonimleştirme aracı: Hassas verileri gizleyin! https://odya.com.tr/blog/veri-anonimlestirme-araci-kvkk-gdpr-uyumlu-hassas-verikoruma/ PECB. (2025, July 8). The future of privacy with ISO/IEC 27701. https://pecb.com/en/whitepaper/the-future-of-privacy-with-isoiec-27701 Polymer HQ. (2024, September 6). What is changing in ISO 27001 with 2022 updates? https://www.polymerhq.io/blog/iso-27001/what-is-changing-in-iso-27001-with-2022- updates/ Reisman, D., & Nissim, K. (2019). Towards formalizing the GDPR's notion of singling out. arXiv preprint arXiv:1904.06009. https://arxiv.org/pdf/1904.06009 SPIDYA. (2026). Veri anonimleştirme aracı. https://odya.com.tr/blog/veri-anonimlestirmearaci-kvkk-gdpr-uyumlu-hassas-veri-koruma/ Sweeney, L. (1997). Guaranteeing anonymity when sharing medical data: The Datafly system. Proceedings of the AMIA Annual Fall Symposium, 51–55.
Vries, M. de, & Oprescu, A. (2023). Energy cost and machine learning accuracy impact of kanonymisation and synthetic data techniques. arXiv preprint arXiv:2305.07116. https://arxiv.org/pdf/2305.07116 Wagner, I., & Eckhoff, D. (2019). Technical privacy metrics: A systematic survey. ACM Computing Surveys, 51(3), Article 57. https://doi.org/10.1145/3168389 Wikipedia. (2026). ISO/IEC 27000. https://en.wikipedia.org/wiki/ISO/IEC_27000
