← All posts
Running a motivated intruder testBased on ICO anonymisation guidance
The motivated intruder test, step by step
The ICO asks a simple question of any de-identified dataset: could a determined, reasonably competent person work out who's who?
What the intruder has
- The internet, social media and public registers.
- Reasonable skills and time.
- No special access or insider knowledge.
Common failures
- Rare job titles that identify one person.
- Signatures and footers left in emails.
- Small teams where 'the finance manager' is one person.
Key takeaways
- It's the practical standard regulators use.
- Rare details re-identify more than names.
- Fix, re-test and document.
What could your company's records earn?
A free, nine-question estimate. No files, no logins.
More in Privacy & law
Data brokers and national security: what the UK government is asking
DSIT's 2025 call for evidence asked how brokers keep data away from hostile actors. What it covered, and the checks every broker should run now.
Personal data that must never leave: a checklist
Special category data, criminal records, children's data and more: what to exclude before any data deal.
The Data (Use and Access) Act 2025: what changed for UK businesses
The UK's 2025 data law reforms, in brief: recognised legitimate interests, complaints duties and more.