November 25, 2025

A Guide to Privacy-Enhancing Technologies (PETs)

Data has never been more valuable—or more vulnerable. Individuals expect their information to be protected and used responsibly, and regulators are enforcing those expectations with increasing rigor. A single security incident, data breach, or misuse of personal data can cost organizations millions in fines and loss of trust. The difference between unlocking growth and facing serious consequences can often be made by how your organization handles data.

Organizations frequently possess extensive datasets with untapped potential, but often they hesitate to leverage it, unsure how to use it without violating data privacy laws. Insights that could drive product improvement or uncover opportunities are left untapped due to a lack of lawful, privacy-protected ways to use the data.

This is the kind of problem organizations have been trying to solve for years, and where privacy-enhancing technologies (PETs) can make a difference.

What Are Privacy-Enhancing Technologies (PETs)?

Privacy-Enhancing Technologies (PETs) are tools and technical measures designed to protect personal information. PETs allow organizations to analyze, leverage, and collaborate on personal data while reducing privacy risks and supporting regulatory compliance.

At their core, PETs help safeguard personal data by embedding privacy-by-design into data-processing activities. They have emerged as innovative technical solutions that can strengthen confidentiality and privacy protections and support compliance efforts. When used appropriately, PETs empower businesses to use personal data more responsibly, reduce exposure, and help build customer and stakeholder trust.

Common PETs and How They Work

PETs can come in many forms, and they are built on the back of a diverse range of technologies, each with unique strengths and applications. Below are some of the most widely used PETs, along with a high-level overview of how each functions in practice.

Data Anonymization

Anonymization is the process of irreversibly altering personal data to ensure that individuals cannot be identified, directly or indirectly, by any reasonable means. The bar is very high, but once data is anonymized, it falls outside the scope of many data protection laws, like the General Data Protection Regulation (GDPR). Common techniques to reduce identifiability include removing direct identifiers, aggregating data into ranges (e.g., age groups instead of exact birthdates), and adding statistical “noise.” However, under laws like the GDPR, true anonymization requires that re-identification is practically impossible, even with additional data.

Pseudonymization

On the other hand, pseudonymization replaces identifying information with artificial identifiers or pseudonyms. This technique, often also known as key coding, reduces the direct link to an individual, but the process remains reversible using separately stored additional information or a key. Because re-identification is still possible, pseudonymized data continues to be classified as personal data—in most cases, though not all—under regulations like the GDPR.

Pseudonymization is often applied in pharmaceutical research. It is particularly useful to study safety or efficacy of medicines without exposing sensitive personal health information.

Encryption Techniques

Encryption techniques allow organizations to encode data using algorithms, protecting confidentiality across storage, transmission, and, with advanced PETs, during processing. Only those with the correct credentials or keys can unlock and read the data, supporting legal requirements for confidentiality and access control.

For example, financial institutions use encryption to protect sensitive customer data during online transactions. When online payment is made, the card information is encrypted, preventing unauthorized parties from intercepting and reading it, thus reducing the risk of a data breach.

Differential Privacy

Differential privacy is a mathematical framework that enables the analysis of large datasets to gather insights about groups without revealing information about any single individual. It works by injecting a carefully calibrated amount of statistical “noise” into the data.

The U.S. Census Bureau adopted differential privacy for the 2020 Census to protect the identities of individuals while releasing valuable demographic data. This ensures that the output of a query remains statistically useful while making it impossible to determine whether any specific person’s data was included in the computation.

Secure Multiparty Computation (SMPC)

Confidential computing can be achieved through techniques like Secure Multiparty Computation (SMPC), a cryptographic protocol that allows multiple parties to jointly compute a function over their combined private data without revealing that data to each other. Each party’s data remains within their own secure environment.

Banks face a wave of phishing attacks daily. Ordinarily, they’d hesitate to compare notes due to confidentiality, regulatory, and competitive considerations. With confidential computing and secure multi-party computation, banks can analyze encrypted attack patterns collectively without exposing underlying customer data or sensitive internal information.

Limitations and Considerations

PETs are powerful tools, but they are not infallible. When adopting PETs, decision-makers must understand what PETs realistically can achieve and recognize the boundaries of their capabilities. Many PETs require deep technical expertise and careful integration work, with more advanced PETs often relying on costly specialized hardware and skilled resources. Mistakes in configuration, implementation, or ongoing management can weaken their protective value and create a false sense of security.

Organizations should not view PETs as silver bullets. Instead, PETs work best as part of a layered security and privacy program that includes governance, policies, risk assessments, and operational controls.

Regulatory Requirements Across Jurisdictions

In the U.S., data protection and security laws—such as the Health Insurance Portability and Accountability Act (HIPAA) in healthcare, the Gramm-Leach-Bliley Act (GLBA) in financial services, and the Federal Trade Commission’s (FTC) data-security guidance—require organizations to adopt “reasonable and appropriate” safeguards for personal data. Even though these laws might not specifically require the use of particular PETS, they can help demonstrate effective risk mitigation and compliance with those obligations.

In Europe, the GDPR explicitly promotes techniques such as anonymization and pseudonymization—particularly in Articles 25 (data protection by design and by default) and 32 (security of processing)—and bodies like the European Union Agency for Cybersecurity (ENISA) and other EU bodies offer practical guidance on PET adoption.

In the APAC region, privacy and data protection frameworks in Australia, Singapore, and Japan encourage the use of technical safeguards—such as encryption, de-identification or anonymization, and access-control measures—through their security requirements and regulatory guidance.

While the approaches and regulatory language may differ across regions, these examples illustrate that technical safeguards, including PETs, can play an important role in meeting various regulatory expectations.

Why Do Organizations Adopt PETs?

Businesses use PETs to minimize privacy and security risks, strengthen stakeholder trust, and support compliance obligations under regulations such as GDPR, CCPA, HIPAA, and various APAC privacy laws. By limiting identifiability and controlling how sensitive data is accessed or processed, PETs can help organizations demonstrate that they have implemented appropriate safeguards and mitigated key regulatory risks.

PETs also serve as important business enablers. They can allow organizations to collaborate on research, development, and AI projects without exposing personal information. In healthcare, for example, hospitals, research centers, and biotechnology companies can jointly train AI models to improve diagnostic performance without exchanging identifiable patient data. This enables richer insights, more accurate models, and better health outcomes while maintaining strong privacy protections.

Conclusion

As organizations navigate increasingly complex data ecosystems, PETs offer practical ways to reduce exposure, support compliance, and enable responsible innovation. PETs do not eliminate security incidents, but they can significantly reduce risks—helping organizations demonstrate reasonable safeguards and preserve trust.

Beyond risk mitigation, PETs are becoming important business enablers. They allow teams to collaborate, analyze data, and develop advanced models—often across institutional or geographic boundaries—without unnecessarily revealing personal information. When thoughtfully selected and integrated, PETs strengthen both privacy protections and operational outcomes.

VeraSafe can help organizations assess whether PETs fit into their privacy strategy, explain their potential and limitations, and advise on how they complement compliance efforts. We also support vendor evaluation and help incorporate PETs into assessments and governance documentation.

For more insights and guidance, listen to VeraSafe’s podcast episode on PETs featuring Google’s EMEA Privacy Lead, Monisha Varadan: