The data you plan on using is anonymised to a certain degree. But is it effectively anonymised in the eyes of the law?

You indicated that the data you will use has undergone anonymisation beyond simple pseudonymisation.

You now need to assess whether the data is effectively anonymised from a legal standpoint.

Data that has been effectively anonymised is not considered ‘personal data’ and their use does not raise privacy or ethical issues.

Anonymisation is not a black and white concept. It lies on a spectrum.

Anonymisation techniques can be applied to personal data to varying degrees. The degree of anonymisation is directly linked to the risk of re-identifying individuals from the data.

Data processing techniques are ever evolving and new data sources keep emerging that allow re-identifying individuals from datasets that may feel safely anonymised. You can read more on anonymisation and risks of re-identification from the Anonymisation Code of Practice issued by the Information Commissioner’s office (ICO).

How will I assess whether my dataset is effectively anonymised?

If you are using an existing dataset, check with your data provider that the data has been assessed to be effectively anonymised; and that the way you will be using the data is in line with the way the data provider intended the data to be used.
Read official guidelines on data privacy and the UK General Data Protection Regulation (UK GDPR) from the Information Commissioner’s Office (ICO). The ICO offers a series of toolkits to assess your compliance with data protection laws.
If in doubt, please ask for support from the Health Research Authority: Health Research Authority (hra.nhs.uk)

Having reviewed all that information, do you think the data you are using is effectively anonymised? i.e., that the risk of re-identifying individuals is sufficiently low?

Yes

Further resources

Please note some of these are issued by organisations outside the UK but still cover important concepts around data privacy and data protection.