What is Re-identification Attack Testing?

In practice, this involves simulating realistic attacks that combine released data with auxiliary datasets, model outputs, or external information to see whether an individual can be singled out or inferred. Compliance teams use these tests to assess whether anonymization claims are credible, whether controls such as aggregation, suppression, noise, or access restrictions are effective, and whether residual risks remain acceptable.

This testing is especially relevant when organizations publish datasets, use synthetic data, share model outputs, or rely on de-identification to reduce privacy obligations. The concept is closely tied to the GDPR, EU AI Act data governance expectations, ISO 27001 security controls, ISO/IEC 42001 management controls, and privacy risk management approaches reflected in NIST AI RMF; it is also relevant to sectors with heightened confidentiality and operational risk requirements.