# Coded Data > Coded Data means anonymized data, with all direct personal identifiers replaced by unrelated symbols **Term:** Coded Data **Last updated:** 2026-07-29 ## Definition ## What Coded Data Means in a Contract In a contract, Coded Data refers to a dataset where obvious personal identifiers, names, addresses, national identification numbers, and similar direct markers, have been stripped out and substituted with symbols, numbers, or other codes that carry no inherent meaning to an outside party. Unlike fully anonymized data, coded data typically remains re-identifiable because a separate key or lookup table exists somewhere, held either by the party generating the data or by a trusted third party. The contract's treatment of Coded Data hinges on this distinction: it is a risk-reduction technique rather than a guarantee of permanent anonymity. Because the re-identification key exists, many data protection frameworks still treat coded data as personal data in the hands of whoever controls the key. Contracts must therefore be precise about who holds that key, how it is protected, and under what circumstances re-identification is permitted. Parties drafting a [Data Processing Agreement](https://www.genieai.co/en-us/template-type/data-processing-agreement) often use Coded Data as a middle category between raw personal data and truly anonymized data, applying tailored security and access controls accordingly. Understanding this term correctly protects both parties: a recipient of Coded Data should not assume it is free from data protection obligations, and a discloser should not overstate the protection the coding provides. ## How Coded Data Is Defined or Measured Definitions of Coded Data in commercial agreements generally specify three elements: which fields count as direct identifiers requiring replacement, what coding methodology is used, and where the corresponding key is stored. Some contracts require that the key be held by a party unrelated to the recipient of the coded dataset, reinforcing separation between the coded information and the means to reverse it. Measurement or verification of coded data quality is usually addressed through audit rights, technical specifications, or reference to recognized coding standards agreed by the parties. A contract may require periodic testing to confirm that codes remain unrelated to the original identifiers and that no residual identifying patterns persist in the dataset. - Which categories of personal identifiers must be coded before disclosure. - Who controls the key linking codes back to individuals. - What security measures apply to both the coded dataset and the key. - How re-identification requests, if permitted, must be authorized and logged. ## Where Coded Data Appears in Agreements Coded Data provisions commonly appear in agreements involving research collaborations, clinical trials, analytics services, and outsourced data processing. A [Data Sharing Agreement](https://www.genieai.co/en-us/template-type/data-sharing-agreement) may permit a recipient to use coded data for statistical analysis while prohibiting any attempt to obtain or apply the re-identification key. Similarly, a [Data Transfer Agreement](https://www.genieai.co/en-us/template-type/data-transfer-agreement) might classify coded data as a lower-risk transfer category, subject to reduced but still meaningful safeguards. The term also surfaces in [Data Protection Impact Assessment](https://www.genieai.co/en-us/template-type/data-protection-impact-assessment) documentation, where organizations evaluate whether coding sufficiently mitigates risk before proceeding with a proposed processing activity. In industries such as [Healthcare](https://www.genieai.co/industry/healthcare) and [Finance](https://www.genieai.co/industry/finance), where sensitive personal information is routine, Coded Data clauses help balance research or analytical value against privacy obligations. Vendors and service providers frequently reference Coded Data when describing deliverables in statements of work, particularly where analytics outputs are shared with clients but the underlying identifiable dataset stays with the original controller. ## Why the Exact Wording Matters Loose or ambiguous drafting around Coded Data creates real legal risk. If a contract fails to state clearly who controls the re-identification key, a receiving party might unintentionally acquire obligations, or rights, it did not anticipate. Equally, if the contract does not restrict attempts at re-identification, the protective value of coding is undermined, and the data may effectively be treated as personal data under the law governing the contract. Precise wording also affects liability allocation. A breach involving coded data without the key is generally lower risk than a breach exposing both the coded dataset and the key together. Contracts that fail to distinguish these scenarios in their breach notification or indemnity clauses may produce disproportionate remedies or, conversely, leave a genuine risk unaddressed. ## Drafting Considerations Drafters should define Coded Data with enough specificity to distinguish it from both raw personal data and anonymized data, avoiding reliance on generic or interchangeable language. The definition should identify the coding method, the key custodian, and any restrictions on combining coded data with other datasets that could enable indirect identification. It is also prudent to align Coded Data provisions with related security obligations found in a [Data Protection Addendum](https://www.genieai.co/en-us/template-type/data-protection-addendum) or equivalent schedule, ensuring that access controls, breach notification triggers, and audit rights are consistent across the agreement. Contracts should specify remedies and notification timelines separately for incidents involving coded data alone versus incidents where the key is also compromised. Finally, parties should consider including a prohibition on re-identification except in narrowly defined circumstances, together with a requirement to notify the counterparty of any permitted re-identification event, to preserve trust and regulatory compliance throughout the life of the agreement. ## Context ### Relevant circumstances - Research collaborations involving data sharing. - Business partnerships where data exchange is integral. - Operations involving customer or employee data usage. ### Relevant sectors - Healthcare - Finance ## Relevant contract types - [Data Processing Agreement](https://www.genieai.co/en-us/template-type/data-processing-agreement) - [Data Sharing Agreement](https://www.genieai.co/en-us/template-type/data-sharing-agreement) - [Data Transfer Agreement](https://www.genieai.co/en-us/template-type/data-transfer-agreement) --- This is the Markdown representation of [https://www.genieai.co/en-us/define/coded-data](https://www.genieai.co/en-us/define/coded-data), provided for AI agents and crawlers. The HTML page is canonical. See [/llms.txt](https://www.genieai.co/llms.txt) for the full content map.