Privacy-Enhancing Technologies for Data

What it is

The UK Information Commissioner's Office describes them as software and hardware solutions that achieve specific privacy or data protection functionality, or protect against risks to the privacy of a person or group.

Its guidance covers eight: differential privacy, synthetic data, homomorphic encryption, zero-knowledge proofs, trusted execution environments, secure multiparty computation, private set intersection and federated learning.

They work in different ways. Differential privacy, in the words of the US standards body NIST, is a mathematical framework that quantifies privacy loss. Others compute on encrypted data, split a computation between parties, or isolate processing in protected hardware.

Why it matters

They offer a way to use or share data that would otherwise be too sensitive. A regulator has published detailed guidance and updated it in September 2026, and NIST finalised guidelines for evaluating differential privacy in March 2025.

The same regulator is cautious. It says these technologies should not be regarded as a silver bullet, that some may not be mature enough in scalability, standards and robustness to attack, and that they can need significant expertise. DII has read no evidence of how widely enterprises use them.

The problem it addresses

DII editorial view

Some valuable uses of data are blocked because the data identifies people: joint analysis between organisations, published statistics, work on sensitive records. Removing names is often not enough. These techniques limit what the data reveals while it is being used.

Business and organisational relevance

DII editorial view

These techniques are a response to a risk, not a capability to acquire for its own sake. The decision to use one belongs with whoever owns the data protection risk, with engineering advising on what is feasible.

Practical use cases

• Publishing statistics with a quantified privacy guarantee
• Joint analysis between organisations without exchanging raw data
• Processing sensitive data in a protected environment

Benefits and opportunities

• Data minimisation in practice
• Collaboration that would otherwise not be permitted

Risks, limitations and dependencies

• "You should not regard PETs as a silver bullet to meet all of your data protection requirements"
• "PETs can require significant expertise to set up and use appropriately"
• Inappropriate implementation, such as poor key management

Prerequisites for adoption

DII editorial view

• An impact assessment that identifies the risk to be reduced
• Specialist expertise; a poor implementation can undo the protection
• A way to evaluate the guarantee the technique claims

Implementation considerations

• Start from the risk, not the technique. The regulator advises considering these technologies where an impact assessment has identified risks to people.
• Do not treat one as compliance. Using one does not remove obligations under data protection law.
• Check the expertise you have. A poor implementation, such as weak key management, can undo the protection.
• Ask how the guarantee is evaluated. For differential privacy, published guidelines describe what to examine.

The DII Radar assessment

Catalogue status

Not yet assessed. DII has not published a Radar assessment for Privacy-Enhancing Technologies for Data. It is listed in the catalogue so that it can be explained. No relevance, direction, strategic impact or enterprise adoption is given for it, and it is not plotted on the Radar.

What to consider next

DII editorial view

• Start from the risk, not the technique
• Do not treat use of one as compliance in itself
• Check that you have the expertise to implement it properly