How fast should a buyer de-identify your data?
The short answer
A de-identification timeline says how many days a buyer has to take names out of your data. Ryan Lock of Polyshares suggests asking for about 14 days and a deletion certificate. That is one buyer's advice, not a rule. Until the names are out, the buyer holds your raw data.
De-identification means taking names and other details out of records. The timeline is how long the buyer takes to do it.
Why does the gap matter?
Lock calls the time between extraction and finished de-identification the riskiest period for an owner (X article). Our page on safety says that in most models a buyer handles raw data before names come out.
Mercor's breach in March 2026 is the dated test case. Reports put about four terabytes at risk. See the breach page.
Extract
Data leaves your systems.
Raw files held
Names still inside.
De-identified
Names come out.
Raw deleted
Ask for a certificate.
What does the article suggest?
Ask for de-identification to finish within about 14 days of extraction, scaled to the size of the data. Ask for a certificate of deletion once the raw files are transformed.
Lock also says most deals include no such terms. That is his view, and we found no survey to confirm it.
Do the companies handle raw data the same way?
No. Lock says third-party firms do the work so Polyshares never touches raw files. Its data handling page says two Polyshares people can see an unmasked record (page).
micro1 staff said in an undated recorded forum talk that micro1 transforms data itself. micro1's David Revland described swapping names for consistent stand-ins. See micro1 PII transformation.
Frankfurt Kurnit, a law firm, advises limiting access to raw data and requiring certification of the de-identification to your satisfaction.
What belongs in the contract?
- A completion date.
- Who does the work.
- A deletion certificate.
- What happens if the date slips.
Read data de-identification first. Talk to a privacy lawyer in your state before you sign.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Have a lawyer read any contract before you sign. They like that.
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
