A small sales summary may still reveal an individual customer's activity
Yes, and the absence of names does not settle the question. ICO anonymisation guidance explains that people can be identifiable through singling out, links to other information and the context of release, not only through direct identifiers. A group of one buyer in a region, an unusually large order or a story that matches a public forum post can each point at an individual. Review the audience, group sizes, rare combinations and plausible outside knowledge before release, and hold or reshape the item where a row stays unresolved.
For: A research-only merchant preparing a public sales chart, case study, testimonial summary or community post drawn from real order data.
Aggregation is a context question, not a word count
Removing names, emails and order numbers is the beginning of the review, not the end. The ICO's anonymisation guidance treats identifiability as a question about singling out, linkability and the circumstances of release. A person can be identifiable because they are the only one matching the published description, because the figures can be combined with information the audience already has, or because the release reaches people who know the customer.
This means a chart of three buyers in one city and a detailed story about one unusual order can both be identifying even with no direct identifier attached. Conversely, the guidance does not supply a universal safe group size. There is no number above which publication is automatically fine; the answer depends on the population, the audience and what else is publicly knowable.
Apply this review to anything derived from real customer activity: dashboards shared publicly, social posts about order milestones, case studies, testimonial compilations and responses to press or provider questions. The fact that the source data is genuinely held by the store does not make its summarized form safe to release.
Test the specific publication, not the category
Start with the exact item proposed for release: the chart, sentence or story as it will actually appear, including captions and surrounding text. Identify the smallest group any figure describes. Where a figure could describe one or two real orders, record that plainly. Do not average your way past it mentally; a regional breakdown, a date range and a product filter can each shrink the group.
Next, list rare or distinctive combinations the item reveals. An order of an unusual size, a delivery to an unusual location, a first-time product launch or a sole bulk purchase is the kind of fact that singles someone out. The more specific the combination, the more likely a reader who knows one piece can infer the rest.
Then consider linkability: what public facts exist that could be joined to this item. A customer who posted publicly about their purchase, a company known to be running a project, or a buyer visible in your own marketing can each supply the missing link. You are assessing plausible connections for the actual audience, not proving that someone will definitely make them.
Decide who the audience is and what they already know
The same figure carries different risk depending on where it appears. A number shared inside a small professional community where buyers know each other is a different release from a number on a public homepage. Identify the actual destination: public site, newsletter, forum, pitch deck or provider submission, and who reads it.
For small or closed audiences, assume readers may hold contextual knowledge about who buys from you. A summary that seems abstract to a stranger can be transparent to a peer. If the audience includes people who could recognize the customer, treat that as a finding to resolve, not a footnote.
Where the item exists because a customer agreed to be featured, check what the agreement actually covered. Consent to a testimonial is not automatically consent to publish order values, dates or combinations the customer may not have anticipated. The scope of any permission belongs in the review record.
Reshape, generalize or hold the item
Where the review flags a row, choose the least invasive fix that preserves the legitimate point: widen the date range, merge the small category into a larger one, drop the rare dimension, remove the linking detail or convert a specific story into a generalized description that no longer traces to one order. Each change should be visible in the review record so the reasoning survives staff turnover.
Some items cannot be fixed by editing. If the honest version of the figure is one customer's activity and no aggregation removes that, hold publication and mark the row unresolved for the owner responsible for customer information. A suppressed or reshaped figure is a legitimate outcome of this review, not a failure of it.
Record who approved the final item and against which version of this review. If you want a scoped Prism website review to look at proposed public claims drawn from customer activity, bring the draft wording and a non-sensitive description of the underlying data; scope, responsibilities, fees and terms are confirmed before work. Keep the raw customer records themselves out of the inquiry.
Aggregate-publication review
Complete one review per proposed publication item before release. An item is publishable only when no row remains unresolved for its intended audience. This review assesses identifiability in context; it does not certify legal anonymization.
Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.
Aggregate-publication review. The last column is for temporary notes.
Review check
What to examine and why
Your finding
Exact publication item
What to examine and whyThe chart, sentence or story as it will appear, with captions and surrounding copy. Defines what is actually being released; a vague description of the item cannot be reviewed.
Smallest described group
What to examine and whyThe fewest real customers or orders any figure or statement could describe after filters, dates and regions. A group of one or two is a singling-out flag that must be resolved, not averaged away.
Rare combinations
What to examine and whyUnusual order sizes, locations, products or timings the item reveals together. Distinctive combinations let a reader single out a person even inside a larger group.
Linkable public facts
What to examine and whyCustomer posts, known projects, prior marketing or other public information that could join to this item. Plausible links for the real audience keep the item identifying despite removed names.
Audience and destination
What to examine and whyWhere the item will appear and who reads it, including closed professional communities. Context knowledge in the audience changes the identifiability answer for the same figure.
Customer permission scope
What to examine and whyWhat any featured customer actually agreed to, from the retained agreement record. Permission for one use does not silently extend to publishing order details or combinations.
Reshaping decision
What to examine and whyWidened ranges, merged categories, dropped dimensions or generalization applied to the draft. Documents how the flag was resolved while preserving the legitimate point.
Hold or release owner
What to examine and whyThe person approving release, the reviewed version and any row left unresolved. Unresolved rows mean hold; the owner of customer information decides the path forward.
These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.
Limits
ICO anonymisation guidance is UK guidance and is under review; it supplies the singling-out, linkability and context framework, not a ruling on this merchant or a universal safe minimum group size.
Completing this review does not establish that an item is legally anonymized or that any privacy-law obligation is satisfied; legal conclusions belong to qualified review.
Do not place raw customer records, order details or identifying combinations in the worksheet or the public consultation form.
A decision to publish a summary says nothing about product legality or payment-provider approval.
ICO: Effective anonymisation — checked 2026-10-01. People can be identifiable without names through singling out, links to other information and release context. The guidance does not set a universal safe minimum group size or certify anonymisation.
Prism features — checked 2026-09-21. An agreed website review can cover product descriptions, marketing claims, store policies and business disclosures, with informational findings rather than legal opinions or certification.