Anonymising a transcript looks like a find-and-replace job. Swap the names for pseudonyms, remove the employer, done.
It is not, and the reason matters both ethically and legally: what identifies a participant is almost never their name. It is everything else they said.
The combination is the identifier
Consider a transcript that has been scrupulously de-named. It still says the participant is in their mid-fifties, female, leads a radiology department, works at a hospital in a small Norwegian city, and moved there from Denmark eight years ago.
Every one of those facts is unremarkable. Together they describe exactly one person, and anyone in Norwegian healthcare could name her in a minute.
This is re-identification by combination, and it is the central problem in anonymising qualitative data. Each attribute — age band, role, sector, region, tenure, an unusual career move — narrows the population. Four or five ordinary attributes routinely narrow it to one.
The question to ask is not “have I removed the identifiers?” but “how many people could this be?” If the answer is one, it is not anonymous, however many names you replaced.
Pseudonymous is not anonymous, and the law is explicit
Researchers routinely conflate these, and the distinction has real consequences.
Pseudonymised data has had identifiers replaced but can still be linked back to a person using additional information — a key file, a recruitment list, the recording. Anonymous data cannot be linked back by any means reasonably likely to be used.
Recital 26 of the GDPR draws the line precisely: data protection principles do not apply to genuinely anonymous information, but pseudonymised data that could be attributed to a person by the use of additional information remains personal data. Whether data is anonymous is assessed against the means reasonably likely to be used to identify someone, accounting for cost, time and available technology.
The practical consequence: if you hold a key linking pseudonyms to participants, your transcripts are still personal data and your obligations continue. That is often fine and appropriate — longitudinal studies need it — but it should be a decision rather than an accident.
What to remove
Direct identifiers
- Participant names, and the names of everyone they mention — colleagues, family, clients, patients
- Employer, institution, team and project names
- Contact details, social handles, participant ID numbers used elsewhere
- Precise locations: street, building, campus, ward, branch
Quasi-identifiers — the ones that do the damage
- Exact age, replaced with a band
- Exact dates, replaced with a period
- Specific job titles, replaced with a role category
- Unusual career paths and tenure lengths
- Distinctive events: a named restructure, an incident that made the news, an award
- Rare characteristics — a rare condition, an unusual qualification, a minority language
In the file itself
- Document metadata carrying the researcher’s name or the original filename
- Tracked changes and comments, which survive conversion to PDF
- Speaker labels that use real initials
- The audio filename embedded in transcription software output
Techniques that work
| Technique | What it does | Watch out for |
|---|---|---|
| Consistent pseudonyms | Replace each person with a stable alias | Use a naming scheme that cannot be mistaken for real participants |
| Generalisation | ”Mid-fifties” not 54; “Nordic region” not Bergen; “clinical lead” not head of radiology | Generalise until the count is plausibly large |
| Suppression | Remove a detail entirely rather than blurring it | Note in the transcript that something was removed, so the gap is visible |
| Aggregation | Report a pattern across participants rather than an individual account | The safest option for distinctive cases |
| A separate key | Kept apart from the data, with its own controls | Destroy it when the protocol says to |
Do not rely on find-and-replace alone. Participants refer to people obliquely — “my sister-in-law who works at the ministry” — and those references survive every automated pass. Read the transcript through afterwards, specifically looking for who could be worked out.
Check the quotes twice
The most common leak in published qualitative work is a quotation.
A quote is selected precisely because it is vivid and distinctive, which is exactly what makes it identifying. A turn of phrase, a specific complaint about a named system, a reference to a particular meeting — any of these can identify a speaker to colleagues, who are usually the audience the participant was most worried about.
Check every quote you intend to publish against the question: could someone in this person’s workplace recognise them from this? If the answer is maybe, paraphrase or aggregate.
Recordings are identifiers too
A voice recording identifies a person directly. Where biometric characteristics are processed for the purpose of identification, EU law treats them as special category data with a higher bar.
Whatever your consent form promised about storage and destruction of recordings is a commitment, not a formality. If the protocol says recordings are destroyed after transcription, destroy them — and remember that a transcript derived from a recording is a derivative of personal data whether or not the audio still exists.
Do not just cover it
If you are working in PDF, a black box drawn in a viewer sits on top of the page while the text stays in the file, recoverable by selecting and copying. For a transcript that has been through an ethics approval promising anonymity, that is a breach of the undertaking you gave a participant, not a formatting error. The mechanism is set out in redaction vs whiteout.
The same applies to a Word document converted to PDF with comments and tracked changes intact — the reviewer’s note asking “is this the participant from the Bergen site?” travels with the file.
Check before you share
- Select all, copy, paste into a plain text editor. Search for every real name, employer and place you removed.
- Read it as an outsider from the participant’s own workplace. That is the threat model that matters.
- Count the candidates for each participant. If it is fewer than a handful, generalise further.
- Read the document properties for the researcher’s name and the original filename.
- Check every quotation individually before publication.
Doing it
Redact PDF removes the selected text from the file and rewrites the document rather than covering it, and clears metadata, attachments and comments in the same pass — the last of which is where transcription software and word processors leave the material that undoes an anonymisation.
It runs in your browser, so transcripts collected under a confidentiality undertaking are not uploaded to a third party as part of honouring it.
Sources and further reading
- Regulation (EU) 2016/679 (GDPR), Recital 26 — the test distinguishing anonymous from pseudonymised data, and the “means reasonably likely to be used” standard.
- Regulation (EU) 2016/679 (GDPR), Article 4(5) — the definition of pseudonymisation.
- Regulation (EU) 2016/679 (GDPR), Article 9 — biometric data processed for identification as special category data.
- NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information — linkability and the role of quasi-identifiers in re-identification.
- Bland, M., Iyer, A. and Levchenko, K., Story Beyond the Eye: Glyph Positions Break PDF Text Redaction, PoPETs 2023(3):43–61 — why a redaction that leaves traces of its contents is not a removal.