IPC updates its de-identification guidelines, setting a new standard for responsible data use

TORONTO, Oct. 15, 2025 /CNW/ - Today, the Office of the Information and Privacy Commissioner of Ontario (IPC) released an updated edition of its globally-recognized De-Identification Guidelines for Structured Data. The newly expanded guidelines will help organizations maximize the benefits of data while protecting privacy. Drawing on the expertise of world leading scholars and practitioners, the new guidelines provide clear, practical tools for applying de-identification confidently, effectively, and responsibly.

With rapid advancements in technology and a growing reliance on data to drive innovation and improve public services, strong safeguards are critical for maintaining public trust. The updated de-identification guidelines take into account emerging privacy risks, the evolving regulatory landscape, and developments in privacy enhancing technologies since the original version published in 2016.

"Data has the incredible power to transform our world for the better. But without strong privacy safeguards, the public's trust will not follow," said Patricia Kosseim, Information and Privacy Commissioner of Ontario. "Our updated de-identification guidelines give organizations the tools they need to de-identify, use, and share data responsibly, maximizing its utility for research, innovation, and the public good, while also minimizing privacy risks for the people we serve." 

The IPC's guidelines have been updated and expanded to address the need for more operational guidance, with a greater focus on interoperability. They are intended to complement emerging international standards and regulatory developments -- keeping Ontario in step with global best practices in data privacy and governance.                                                                                  

The guidelines were developed in collaboration with the IPC's Scholar-in-Residence, Dr. Khaled El Emam, a world-renowned expert in de-identification, and further informed by extensive consultations with many interested parties. The updated guidelines reflect lessons learned from real-world application, and include step-by-step processes, practical tools, useful checklists, fact sheets and case studies. Key topics include de-identification terminology, data transformation techniques, methods for measuring data utility while mitigating privacy risks, and documentation requirements.

The updated de-identification guidelines support the IPC's vision of being a modern and effective regulator with real-world impact across all four of its strategic priority areas: Privacy and Transparency in Modern Government, Children and Youth in a Digital World, Trust in Digital Health, and Next-Generation Law Enforcement. The IPC encourages all of Ontario's public sector institutions to consult the new guidance.

Learn more:

• Real or fake? The buzz about synthetic data (Info Matters podcast episode)
• The IPC's Scholar-in-Residence program
• Ripe for public debate: Legal and ethical issues around de-identified data (Commissioner's blog)
• IPC Research & Innovation Hub

SOURCE Office of the Information and Privacy Commissioner/Ontario

Media contact: [email protected]