The Protection of Personal Information Act 4 of 2013 (POPI Act) prescribes the conditions for the lawful processing of personal information that includes the retention of de-identified personal information. 

A responsible party has certain obligations regarding the personal information it is not permitted to keep. It can permanently destroy the excess personal information or it can keep the data, not as personal information but as de-identified information. The POPI Act defines ‘de-identify’ to mean deleting any information that:

1. identifies the data subject;

2. can be used or manipulated by a reasonably foreseeable method to identify the data subject; or

3. can be linked by a reasonably foreseeable method to other information that identifies the data subject.

A responsible party wants to conserve the truth of the data. The challenge it will face is balancing compliance with the POPI Act while still finding the information useful. If it deletes too few identifying attributes, re-identification could still happen. If it deletes too many, the de-identified information may be useless. It may require software or logical changes ie permanent masking (replacing data with meaningless values like X or zero).

The practice of data anonymization can be useful. When the balance is right, de-identified information can form the basis of statistical analysis and prediction models to develop products and services, marketing strategies, on the job training programmes and anticipating customer support needs .

In short, data de-identification can be beneficial: it ensures compliance with the POPI Act and can provide value. The company policies should set out the framework to manage data de-identification. It is an irreversible practice so must be done very carefully.