By · Last updated 2026-02-27

返回博客技术

可逆遮盖与永久遮盖的选择

GDPR区分匿名化与假名化。法院需要原件。研究需要重新识别。了解何时使用哪种方法。

February 27, 20267 分钟阅读
redactionencryptionpseudonymizationGDPRe-discovery

核心选择

保护私人记录时,您面临一个关键决策:能否找回原始内容?

永久遮盖永久移除内容,无法恢复。

可逆遮盖将内容转换为可通过密钥还原的形式。

两种方法在AI保护方面效果相同:AI只看到令牌,而非真实的个人数据。区别在于您之后能做什么。

何时必须使用永久遮盖

某些情况下,可逆性本身就是一种风险。

已识别的研究数据集:如果您正在发布供其他研究人员使用的匿名临床数据,即使是控制下的重新识别也可能违反研究伦理委员会协议。GDPR第4(5)条对真正的匿名化数据的保护少于对假名化数据的保护——但前提是匿名化必须是不可逆的。

法律授权的数据销毁:GDPR第17条提供被遗忘权。当个人要求删除数据时,简单地"令牌化"数据而保留查找表并不满足该要求——如果令牌查找表仍然存在,数据实际上并未被删除。

向第三方安全共享数据:如果数据集需要与无权访问原始值的外部方共享,且不需要重新链接能力,永久删除可以消除重新识别风险。

何时必须使用可逆遮盖

大多数企业工作流程需要保留还原能力。

证据开示和法律保全:《联邦民事诉讼规则》第37(e)条对未能保存存储电子信息的当事方施加处罚。保全义务在诉讼可预见时生效,而非在诉讼提起时。如果文件在正常业务过程中被永久匿名化,且保全义务随后生效,则无法满足保全要求。可逆令牌化保留了还原原始文件的能力。

医疗研究中的PHI:HIPAA允许在特定情况下重新链接去标识化数据——例如当研究人员需要随访已纳入研究的患者时。AES-256-GCM加密令牌提供了保持这种能力所需的可逆性。

客户服务记录:如果客户支持团队在对话中使用AI,令牌化版本满足AI保护需求。如果案例随后升级为法律问题,需要原始记录,可逆性使这成为可能。

GDPR假名化(而非匿名化):GDPR第4(5)条将假名化定义为处理方式使个人数据"在不使用额外信息的情况下无法归因于特定数据主体,前提是此类额外信息单独存放"。令牌化满足这一定义并降低了合规风险,同时保留了还原能力。

可逆性的技术实现

令牌替换加查找表:每个检测到的实体在令牌映射表中被记录为键值对。"王小明" → [PERSON_1],映射表保存在您的控制下。令牌化文件处理后,通过映射表还原值。

AES-256-GCM加密:实体值使用AES-256-GCM加密,加密后的值替代原值。没有密钥,加密值无法读取。持有密钥的一方可以解密。

两种方法在AI保护和法律合规方面效果相同,区别在于密钥管理和访问控制架构。

GDPR对这两种情况的处理

GDPR对匿名化数据和假名化数据的处理方式不同:

真正的匿名化(永久,不可逆):技术上不再是GDPR意义上的个人数据。GDPR义务不适用,但这需要经过验证的不可逆性。

假名化(可逆,密钥分开存放):仍然是个人数据。GDPR适用,但第25条和第89条提供了使用假名化数据进行研究和统计目的的激励和便利。

选择哪种方式取决于您的用例,而非哪种方式更"安全"。

请参阅令牌系统指南了解anonym.legal如何实现这两种方法,以及法律合规概述了解发现义务和GDPR方面的相关内容。

参考资料

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.