Why anonymization matters: expired data, irreversibility and proof

Personal data past its retention period is no longer an asset to the organization; it is a liability. It should be deleted, yet in most organizations it is kept indefinitely on the grounds that it “might be needed for analysis”, and every passing year increases the risk from breaches, requests and audits. Anonymization is the way out of that dilemma: it preserves the statistical value of the data while cutting its link to the person irreversibly. Done correctly, the result is no longer personal data; done incorrectly, the organization ends up notifying a breach over a data set it believed was anonymous.

This article is not legal advice; the legal assessment of anonymization for your organization should be confirmed with your legal function.

The problem of data past its retention period

Every piece of personal data is processed for a purpose, and that purpose eventually ends. The contract ends, the employee leaves, the campaign closes, the legal retention period expires. The page “Deletion, Destruction or Anonymization of Personal Data” published by Türkiye’s data protection authority frames three paths for the data at that point: deletion, destruction and anonymization. Which one to choose depends on the data’s remaining value and on legal obligations, but “none of them” is not an option.

In practice, expired data stays in systems for three reasons. First, nobody knows it has expired; the retention period is written in a policy document, but no system binds that period to the data. Second, nobody knows where the data is; the record in the production system is deleted, but the export on the file server, the attachment in the mail archive and the copy in the test database remain. Third, the data still looks useful; historical data is wanted for sales analysis, capacity planning or model training, and deletion is postponed.

The third reason points to a legitimate need and is the reason anonymization exists. Analytical value lies in the distribution, not in the individuals, and the distribution can be preserved without the individuals.

Why anonymization is different

Anonymization is rendering personal data such that it can no longer be associated with an identified or identifiable person by any means, even when combined with other data. The critical part of the definition is “even when combined with other data”. Deleting the name and the national ID number is not anonymization; if date of birth, postal code and gender remain together, the person can be re-identified by matching against another source.

That is what separates anonymization from masking and pseudonymization. Masking hides a value in display, such as replacing all but the last four characters of an IBAN with asterisks; the data set remains linkable to the person. Pseudonymization replaces the identifier with a key or token but keeps a way back; the data is still personal data. Anonymization cuts the link irreversibly. We compare the three concepts in detail in anonymization vs masking vs pseudonymization.

Method	Link to the person	Still personal data?	Typical use
Masking	Preserved (hidden in display)	Yes	Screens, reports, redaction of request responses
Pseudonymization	Reversible with a key	Yes	Test environments, internal analytics
Anonymization	Cut irreversibly	No	Preserving the statistical value of expired data

Irreversibility and the uniqueness check

The quality of anonymization is measured by re-identification risk. The most basic measure is uniqueness: if the combination of remaining attributes in the anonymized set corresponds to only one record, that record is unique and can be re-identified. If there is only one person in a given district, born in a given year, in a given occupation, that person is identifiable even with the name removed.

A uniqueness check computes, for every record in the anonymized set, how many other records share the same combination of attributes. Records that are unique or have few matches require further generalization (an age band instead of an age, a province instead of a district) or suppression (removing the record). The check should be part of the anonymization operation and its result attached to the operation’s evidence. Without a uniqueness result, “we anonymized it” is merely a claim.

An example scenario: an insurance company wants to keep expired policy data for risk modelling. Name, national ID number and address are removed; date of birth, vehicle plate and claims history remain. The uniqueness check shows that the vehicle plate alone makes every record unique. Once the plate is removed and the date of birth is generalized to the year, the number of unique records falls to an acceptable level. Without the check, the set would have been shared as “anonymous” and every record could have been tied to a person through a plate lookup.

The redacted copy and destruction of the original

The most frequently skipped step in anonymization is destroying the original. In many organizations anonymization is understood as producing an “anonymous copy” from personal data, with the original left in place. In that case anonymization has not taken place; the organization has merely produced one more copy, and the original remains in the system past its retention period.

The correct flow has two parts: a redacted (anonymized) copy is produced, the uniqueness check is run, and if the result is accepted, the original is destroyed. Destruction must cover every copy: the rows in the production table, the exports on the file server, the backups in object storage, the attachments in the mail archive. Without discovery infrastructure, not all of those copies can be known and destruction remains incomplete.

Both steps must be evidenced: which data was found and in which sources; which anonymization rules were applied; what the uniqueness check returned; who approved destruction of the original and when it completed. That record is the answer to the audit question “what did you do with data whose retention period expired”.

When anonymization is not the right choice

Anonymization is not appropriate in every case. In small data sets, the generalization needed to remove uniqueness can destroy the analytical value; deletion is then the more honest option. Data containing free text (call-centre notes, e-mail bodies, medical histories) is far harder to anonymize than structured fields; indirect identifiers inside the text can exceed the reach of a detection engine. For such data, human approval after redaction is essential.

Anonymization also cannot be applied to data still under a legal retention obligation; records that must be kept under tax, employment or sector-specific rules remain protected as personal data until that period ends. Which data is subject to which obligation should be defined in the retention calendar through labels, and the decision taken with the legal function.

How Seratus closes these gaps

Gap 1: Retention periods are not bound to the data. In Seratus, classification labels are bound to the retention calendar and to disposal processes. Expired data lands on the “gaps” list of the KVKK suite as “data past its retention period” and enters the disposal or anonymization workflow.

Gap 2: Not all copies of the data are known. Agentless discovery scans file servers, local disks, Microsoft 365, Oracle, SQL Server and PostgreSQL/MySQL databases, S3-compatible storage and PST/OST/MSG archives read-only; copies of the same data found as exports, backups and attachments appear in one list.

Gap 3: Anonymization only produces a copy and leaves the original. Seratus carries out anonymization as producing a redacted copy and destroying the original. Destruction is a remediation action assigned to an owner and carried out under a separate approval authority; quarantine can be used first as a reversible intermediate step.

Gap 4: Irreversibility is not measured. Anonymization quality is measured with a uniqueness check and the result is attached to the operation’s record. If the share of unique records is above the acceptance threshold, the operation requires further generalization before it goes to approval.

Gap 5: Turkish identifiers slip through redaction. The Turkish-specific detection engine finds national ID numbers, IBANs, phone numbers, vehicle plates and ICD-coded health data in context; redaction rests on those findings and passes through human approval.

Gap 6: There is no evidence of destruction. Every anonymization and destruction is written to the audit log with who, when and why; the uniqueness result, the approval chain and the time of destruction sit in the same record. The audit report exports to PDF, Excel or CSV.

Takeaway

The cost of keeping expired data rises every year; deleting it destroys analytical value; anonymization, done correctly, is the only path between the two. Doing it correctly means measuring irreversibility with a uniqueness check, destroying the original and evidencing every step. An anonymization whose copies are unknown, whose quality is unmeasured and whose original stays in place gives the organization nothing but a false sense of security. Seratus runs that flow from discovery to destruction in one console, on the organization’s own infrastructure.