Encryption, Hashing, and De-identification

Encryption, hashing, and de-identification are three distinct technical privacy controls that protect personal data from unauthorized disclosure. They differ in reversibility, mechanism, and appropriate use case. **Encryption** is a reversible transformation that converts plaintext into ciphertext using a cryptographic key. Only an authorized party with the correct key can recover the original data. Examples: AES-256-GCM for data at rest; TLS 1.3 for data in transit. **Hashing** is a one-way, deterministic transformation that converts input data into a fixed-length digest. The transformation cannot be reversed, but the same input always produces the same output — enabling verification without storing the original. Examples: argon2id and bcrypt for password storage; SHA-256 for data integrity checks. **De-identification** removes or transforms data elements so that individuals cannot reasonably be identified from the resulting dataset. Techniques range from rule-based (HIPAA Safe Harbor: remove 18 defined identifiers) to statistical (k-anonymity, l-diversity, t-closeness, differential privacy) to substitution-based (tokenization, pseudonymization). These controls form the technical layer of a privacy architecture. They reduce data sensitivity at storage, transit, and use — and are selected and layered based on whether the original data must remain recoverable, which regulatory obligations apply, and what re-identification risk is acceptable.