An organization must de-identify its data before it is transferred to a third party Which of the following should be done FIRST?

Before de-identifying data, it is important to determine the categories of personal data collected,

such as names, addresses, phone numbers, email addresses, social security numbers, health

information, and so on. This will help to identify which data elements are considered identifiers or

quasi-identifiers, and which de-identification techniques are appropriate for each category. For

example, some data elements may need to be removed completely, while others may be masked,

generalized, or perturbed.

Reference:

Anonymize and De-identify | Research Data Management

Data De-identification: An Overview of Basic Terms - ed