Tuvastatavust

Tuvastatavust is an Estonian term that corresponds to identifiability in English. It describes the extent to which data or combinations of data can be used to identify a specific person, directly or indirectly, given the available attributes and external information. The concept is central in data governance and privacy planning, as higher identifiability implies greater risk of disclosure.

Identifiability is influenced by the content of the data (for example, combinations of attributes such as age, location, and other characteristics), the size of the population represented, and the availability of external data sources that could be used for linkage. In practice, analysts assess re-identification risk when sharing, publishing, or processing data containing personal information.

To reduce identifiability, organizations employ techniques such as anonymization and pseudonymization, and adopt privacy-preserving methods like k-anonymity, l-diversity, and differential privacy. Data minimization, access controls, and robust governance are also used to limit potential exposure.

Legally, identifiability is key under data protection frameworks such as the European Union's General Data Protection Regulation (GDPR). Personal data are defined by their capability to identify a natural person, and the level of identifiability informs risk assessments, lawful bases for processing, and security requirements.

In practice, tuvastatavust guides decisions about data sharing, research, and statistical releases. It helps determine what level of anonymization is necessary, what safeguards to implement, and how to document risk management in privacy impact assessments.