topic Re: How to anonymize the Data (not masking) in SAS Data Management

How to anonymize the Data (not masking)

Biswadas — Mon, 06 Dec 2021 07:38:18 GMT

Hi All,

I want to anonymize few names fields and the requirement is to get the new anonymized names that look real.

For example, DAVID can be changed to something like "CHARLES" (it looks real) nut not ("CFSDJN")

Is there a way in achieving this in SAS?

If not, can it be done in any other tool and technologies?

2. similarly some fields that contain the chars+digits, how to anonymize them?

The new anonymized value also should have same pattern (chars+digits maintaining the positions).

so that the end users will not know that they are anonymized and we need to maintain the integrity in all tables containing the fields, so that the values can be used for joining, primary keys etc.

Note: The anonymized values should be same for every new run.

How to anonymise a name field

Biswadas — Mon, 06 Dec 2021 07:24:15 GMT

Hi All,

I want to anonymize few names fields and the requirement is to get the new anonymized names that look real.

For example, DAVID can be changed to something like "CHARLES" (it looks real) nut not ("CFSDJN")

Is there a way in achieving this in SAS?

If not, can it be done in any other tool and technologies?

2. similarly some fields that contain the chars+digits, how to anonymize them?

The new anonymized value also should have same pattern (chars+digits maintaining the positions).

so that the end users will not know that they are anonymized and we need to maintain the integrity in all tables containing the fields, so that the values can be used for joining, primary keys etc.

Re: How to anonymize the Data (not masking)

LinusH — Mon, 06 Dec 2021 09:23:50 GMT

Funny requirement, is this a way to create test data without inventing data from scratch?

It's hard to invent "real" names etc on the fly, so I would try to pick a random name from you existing base table.

Then create a translation table, with original source value (or id) and new random name. If the same person pops up again, pick from the translation table.

If the person occurs as new, make a new translation etc.

About your other types of data, please exemplify, but I guess you could use the same technique described above for those as well.

Re: How to anonymize the Data (not masking)

LinusH — Mon, 06 Dec 2021 10:23:41 GMT

Also, don't know what emphasis you put in the term "Anonymisation". According to GDPR, personal data can be deemed as anonymous only if it's impossible to revert back to the original value/identiy.

If you scramble values for users, it is classified as pseudonyms.

If you want strict anonymsation given your requirements, it will be harder to achive.

Re: How to anonymize the Data (not masking)

Biswadas — Mon, 06 Dec 2021 11:22:20 GMT

Thanks for your reply.
Actually, I didn't want to trace back to the original values, but only
wanted to ensure that the anonymised data looks a bit meaningful.

Could you please suggest how to achieve normal anonymization in SAS DI
(without expecting the real-like values)?

Re: How to anonymize the Data (not masking)

LinusH — Mon, 06 Dec 2021 11:57:46 GMT

Wihout real life like values is much easier. You can use a hasing function in a mapping expression, like

md5(your_name_column)

If really want to hide the original value, conccatenate a "salt" to your value before hasing. A salt is a contant value that is kept secret from users, so they can't decrypt the value using brute force techniques.

Re: How to anonymize the Data (not masking)

SASKiwi — Mon, 06 Dec 2021 19:24:37 GMT

I'm curious to know why you need to keep your data "real" when it won't be? If you want retain the ability to join on the anonymised variables then they will need to have the same level of uniqueness as the original. I don't know any easy way of doing this while still retaining the same uniqueness. You would be better off using the SAS MD5 function to ensure your recoded values retain their uniqueness and so can still be used for joining purposes.

Re: How to anonymize the Data (not masking)

Biswadas — Wed, 08 Dec 2021 23:14:23 GMT

Thanks for your reply.
I was expecting a real-like name so that the data for test users will be a
bit meaningful.

If I can keep this requirement aside (suppose I want only anonymization and
ready to accept any translated Name), what is the best way to achieve this
in SAS DI?

Similarly, how can I get the similar conversion for my 2nd requirement?
For e.g. Social security number *GF*123456XY should be changed to *YZ*987643
*AB* (by keeping the format same- 2 string-6 digits-2 strings)?

Could you please suggest?

Re: How to anonymize the Data (not masking)

LinusH — Thu, 09 Dec 2021 07:30:02 GMT

As already suggested, create a mapping table that maps existing values a random value picked from your existing data. Any other approach that keep data look like real data is probably much more cumbersome.

Re: How to anonymize the Data (not masking)

AllanBowe — Fri, 10 Dec 2021 13:28:47 GMT

To LinusH's point about making data from scratch - we have a basic macro that can help: mp_makedata()

Currently it just adds random values, but in the future it will be updated to provide relevant data based on the primary key, and formats applied. If you'd like to see it extended just raise an issue.

Re: How to anonymize the Data (not masking)

JackHamilton — Wed, 15 Dec 2021 03:33:03 GMT

If you want to create values that look meaningful but are in fact anonymized, and you want to do it right, you need a team of Computer Science PhD's, not one person doing it as a side project.

There are commercial products that do what you want:

https://www.softwaretestinghelp.com/data-masking-tools/

Re: How to anonymize the Data (not masking)

VincentRejany — Wed, 15 Dec 2021 16:42:48 GMT

We support Data Hashing as part of SAS code (MD5, SHA1, 256, 384, 512, CRC32

https://documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/lefunctionsref/n0b8k12x6fdw4ln1snlsqrxd53gy.htm

and SAS Federation Server

https://go.documentation.sas.com/doc/en/fedsrvmgrcdc/4.4/fedsrvmgrug/n1s7wae3mndbnmn1145y1lezasd8a.htm

You can also refer to this document focusing on the GDPR use case

https://communities.sas.com/t5/SAS-Communities-Library/SAS-Federation-Server-for-GDPR-Data-Masking/ta-p/466772

Lastly, within the SAS QKB CI 32 we have been introducing specific definition for data masking:

Re: How to anonymize the Data (not masking)

rom_c — Mon, 02 Feb 2026 05:04:52 GMT

You might want to look at privacy-first document anonymization tools instead of building everything manually.

There are platforms that automatically detect and anonymize names, IDs, and sensitive fields while keeping realistic values and consistent mappings across tables, so joins and integrity are preserved.

Try Questa AI, which offers a free tier and handles this kind of structured + document anonymization pretty well. It anonymizes locally first and then lets you safely run AI/analysis without exposing raw data.

Might be worth testing for your use case.

Re: How to anonymize the Data (not masking)

rom_c — Tue, 12 May 2026 09:25:51 GMT

Traditional masking is no longer enough for modern AI and analytics workflows. As enterprises adopt LLMs and automated data processing, true anonymization is becoming critical for protecting sensitive business information while maintaining compliance and analytical value.

The future is moving toward privacy-first AI architectures where sensitive data is anonymized before it ever reaches external models or downstream systems. This approach significantly reduces risks related to data leakage, re-identification, and regulatory exposure while still enabling advanced AI capabilities.

Organizations that build privacy and governance directly into their AI pipelines will likely have a major advantage as enterprise AI adoption continues to scale.