Skip to content Learn about the access keys available for Metadata.NSW
A NSW Government website
NSW Government
Metadata.NSW

Data suppression standard 1.0

Default View Data Standard

The Suppression Standard should be read in conjunction with the Data Sharing Guide. The sharing guide provides information on how to determine if data should be shared, while the suppression standard is focussed on data preparation once sharing has been determined to be appropriate.  

Overview of the Data suppression standard

Data suppression is vital for protecting sensitive information and ensuring the privacy of individuals. Suppression prevents the identification of students, staff, or other stakeholders when data is shared. 

This standard defines data suppression rules for aggregate data. Its use across the department will support us to safeguard sensitive information, comply with data privacy standards and support consistent data provision practices regardless of the unit where the data originated.  

NSW Department of Education data domains must comply with the requirements set out in this standard when collecting, managing, sharing and releasing data.

Rationale ▶

Policy alignment

The department is committed to safeguarding personal and health information, in line with the Privacy and Personal Information Protection Act 1998 (PPIP Act), Health Records and Information Privacy Act 2002 (HRIP Act), and the NSW Department of Education's Enterprise Data Standards . This commitment not only reflects legal obligations but also upholds the trust placed in us by the communities we serve.

By implementing effective data suppression techniques, we can adhere to open data principles while maintaining confidentiality and promoting ethical data usage. Failure to adhere to proper data suppression practices can lead to significant risks, including breaches of privacy, loss of public trust, and potential legal ramifications.

Risk management

Data suppression mitigates risks associated with the disclosure of identifiable information.

Inadequate suppression may result in re-identification of individuals or the misuse of sensitive information, which could adversely affect the individuals involved and undermine the integrity of the department’s data management processes.

It is important that consistent thresholds and processes are used across the department. Inconsistent approaches to suppression increase the risk of cross-source re-identification and set up community expectations that are then inconsistently met. 

Details

Requirements ▶

When to use suppression

Suppression should be applied to aggregate data that is released publicly. 1 In general, suppression is not needed when data is for internal use only or is unlikely to be publicly released.

Internal use is defined as use exclusively by departmental employees. The universal application of the suppression rules is appropriate as all staff are required to abide by the department’s code of conduct and data use policies.

The application of an appropriate data suppression approach is especially important for data about individuals from vulnerable groups, as they are more susceptible to harm from data breaches or misuse. When data relates to small groups of people, small cell counts across multiple cells can require significant secondary suppression (suppressing a cell so that another can’t be deduced). 

All data must be used according to the consent provided for its use, which means that the terms outlined in a data collection notice take precedence over the suppression standard. Where suppression (or lack there of) would affect data collection methodologies or data quality, this should be addressed by stipulating the intended use in the collection notice.

Staff may contact the Chief Data Office to discuss how to approach specific data suppression scenarios via Data.Reform@det.nsw.edu.au or CESE.Corro@det.nsw.edu.au.
 

Best practice

The Australian Bureau of Statistics has identified the following as best practice principles for applying data suppression to specific data products in a way that effectively protects privacy while maintaining data integrity:
 

  • Identify sensitive data: Define which fields need suppression.
     
  • Apply suppression thresholds: Set minimum count thresholds for groups to avoid showing data that could reveal individual identities.
     
  • Use consistent suppression: Apply rules uniformly to ensure data reliability.
     
  • Aggregation and generalisation: Aggregate or generalise data (e.g., using ranges or high-level categories) to reduce identifiability.
     
  • Audit and monitor: Regularly review suppression practices to maintain compliance and improve protection strategies.

Following these practices helps ensure confidentiality and reduces re-identification risks in shared data (see Appendix A for worked examples).
 

Data suppression rules

Department staff are expected to align with the following rules when preparing aggregate data for public release, or sharing aggregated data with external parties:

Rule of 10

The rule of 10 is the suppression of any cell in a table2 with a frequency of 10 or fewer and the subsequent suppression of larger cells that could be used to calculate the target cell. This rule is the default suppression method used in the department and is an important mechanism for protecting individual privacy.

The rule of 10 is the default threshold used for data about people and is generally not necessary for data about other entities (e.g., schools, directorates, objects) unless the school information could be used to identify individuals. Public reporting of individual school data may, however, be limited by Section 18A of the Education Act.

This threshold is consistent with ABS practice and balances the need for confidentiality with NSW’s commitments to open data. A rule of 10 is considered quite conservative, with data.gov identifying thresholds of 3, 5 and 10 as common across Australian government agencies. This includes agencies with sensitive data such as Australian Institute of Health and Welfare who use a threshold of 4 or fewer, the federal Department of Education who use a threshold of 5 or fewer, and the NSW Department of Communities and Justice who published Guidelines for publishing results with small sample sizes which recommended a threshold of 5 or fewer for demographic data.

Percentages should be suppressed if the numerator or denominator is less than 10. Small percentages, in and of themselves, are not an identification risk.

When preparing data in consultation with external agencies with different suppression thresholds, the agencies involved should use the most conservative threshold. Unit Record Data sharing is not covered by the standard.

Aggregation

Data can become meaningless if the rule of 10 results in a large percentage of cells being suppressed through initial or subsequent suppression. In these cases, selecting different aggregations should be considered.   

The point where suppressed data is no longer able to be used effectively will depend on the purpose and audience. As a rule of thumb, if more than a quarter of the cells are suppressed, the data is unlikely to be fit for purpose.

Common aggregation approaches include:
 

  • collapsing calendar years.

It is appropriate to use aggregation as the first suppression process, with the Rule of 10 applied to any remaining small cell counts.

Dominance rule

Dominance rules are applied to tables that present magnitude data (e.g., income or turnover), where knowing a dominant group would risk the inappropriate identification of an individual entity such as a company (see Appendix B). The Rule of Dominance relates to commercial considerations, so has limited use in the department.

Exclusions

The roles and responsibilities for ensuring appropriate data sharing are covered by the Data Governance Framework (under development).

There are a range of factors that impact whether data is shared that are not related to whether suppression is adequate or appropriate. These are covered by the department’s Data Sharing Guide and include ensuring that the provision of data is in line with the data collection notice, the level of security available in the user’s environment, welfare considerations, and determining whether the publication of the data is in the public interest.  Where data is being shared, clear guidance on expectations should be provided (see Safety Assessment in the Data Sharing Guide). This standard relates to how suppression should be applied to data and does not address these factors.

Data custodians may be apprehensive about sharing data where an individual or team has previously used data inappropriately or shared it beyond the agreed terms. In general, this is not an issue to be addressed through suppression, but rather it should be remedied through applying the data breach policy or raising the issue through the Chief Data Office. If this approach is inadequate or unsuccessful, it may be suitable to use data suppression on internal data reporting to reduce the risk of unauthorised sharing.

Raw data within source systems is not for public release and is therefore not suppressed.

1 Perturbation may be an appropriate method of de-identification in some cases. The appropriate use of this method is outside the scope of this standard.

2 Note that representing suppression in data visualisations is outside the scope of this standard.

 

 

Supporting documentation and policies ▶

 

 

References ▶

 

 

Glossary ▶

Term

Definition

AECG

Aboriginal Education Consultative Group

EALD

English as an Additional Language or Dialect

NCCD

Nationally Consistent Collection of Data on School Students with Disability

PII

Personally identifiable information (PII) is “Information or an opinion (including information or an opinion forming part of a database and whether or not in a recorded form) about an individual whose identity is apparent or can be reasonably be ascertained from the information or opinion”  

PII is information that, by itself, can be used to identify an individual.

In the department, PII includes but is not limited to: SRN (student registration number), staff or student name, address, date of birth, phone numbers, email addresses, and department user id.

School attributes (such as school name, school code, etc) are not PII as they cannot identify an individual. In a small number of cases, school attributes may add additional information to PII which would then render it identifiable – in these cases, suppression will need to be applied.

Suppression

The process of hiding or generalising specific data points to prevent identification.

A data suppression threshold is the minimum count at which data can be reported without risking the identification of individuals within small populations. For example, if a cell in a dataset contains fewer than a predetermined number of individuals (often 5 or 10), that data is suppressed or aggregated so that the cell count is above the threshold. This practice protects privacy and ensures that sensitive information about specific individuals is not inadvertently disclosed.

 

 

 

Appendixes

Appendix A - Rule of 10 suppression threshold ▶

Appendix A - Rule of 10 suppression threshold

Suppression thresholds are applied to frequency outputs (table cells, sums, means, counts used to create charts / visualisations etc.). They do not apply directly to percentages, although it is appropriate to suppress percentages where the numerator or denominator is 10 or less.

Why – To prevent the re-identification of units in cells with small counts and the identification of individuals.

Rule - The department has identified that a rule of 10 is appropriate in most cases of data about people. Counts of 10 or fewer should not be able to be derived from the available data. Aggregation is also an appropriate way to ensure confidentiality is maintained.

 

Use Case

Granularity

Examples

Additional comments

Enrolment data at student / school level

Student Code / Name

AND/OR

School Code / Name

Example 1 

 

Course enrolment

Example 2

 

Analysis of equity parameters

 

Single demographic characteristic

Example 3

 

Multiple demographic characteristics

Example 4

 

Indigenous Indicator

Example 5

 

 

Aggregation in line with the Aboriginal and Torres Strait Islander data standard (under development)

Remoteness Indicator

Example 6

 

Aggregation in line with the Remoteness Standard

Age Indicator

Example 3

Aggregate with 5 or 10 year ranges

Disability flag

Example 7

 

Disability Category Indicator – by disability category or level of adjustment

Apply approach in Example 3 and Example 4

Combine categories to create a cohort > 10
Simplified suppression Dynamic data reporting Example 8 Applies to dashboards and other dynamic reporting

Note that all example data is fictious and is for illustration purposes only.

 

 

Appendix B - Rule of Dominance ▶

Appendix B - Rule of Dominance

The Rule of Dominance checks magnitude statistics in order to protect commercial interests:
 

  • The largest contributor must contribute less than 50% or
     
  • The two largest contributors must contribute less than 67%

Why – To prevent the re-identification of units that contributes a large percentage of a cell’s total value.

Where – Applies primarily to sums and means for data that may be commercially sensitive.

Base data

Table: Total turnover of community preschools in specific LGAs.

LGA Code

Total Turnover (in million $)

No. of Businesses

Turnover of largest business

Turnover of 2nd largest business

Proportion of largest business to Total

Proportion of two largest businesses to Total

LGA101

1.68

12

0.66

0.59

40%

76%

LGA102

0.94

11

0.14

0.13

15%

29%

LGA103

3.22

20

1.77

0.32

55%

65%

LGA104

2.10

10

0.74

0.46

35%

57%

LGA105

2.05

16

0.86

0.29

42%

56%

Total

9.96

69

1.79

0.80

18%

26%


The highlighted LGAs fall into the dominance rule suppression criteria and hence should be suppressed.
 

LGA Code

Total Turnover

(in million $)

No. of Businesses

Turnover of largest business

Turnover of 2nd largest business

Proportion of largest business to Total

Proportion of two largest businesses to Total

LGA101

1.68

12

0.66

0.59

40%

76%

LGA102

0.94

11

0.14

0.13

15%

29%

LGA103

3.22

20

1.77

0.32

55%

65%

LGA104

2.10

10

0.74

0.46

35%

57%

LGA105

2.05

16

0.86

0.29

42%

56%

Total

9.96

69

1.79

0.80

18%

26%

With treatment using aggregation
 

LGA Code

Total Turnover

(in million $)

No. of Businesses

Turnover of largest business

Turnover of 2nd largest business

Proportion of largest business to Total

Proportion of two largest businesses to Total

LGA101, LGA103

4.90

32

1.77

0.66

36%

50%

LGA102

0.94

11

0.14

0.13

15%

29%

LGA104

2.10

10

0.74

0.46

35%

57%

LGA105

2.05

16

0.86

0.29

42%

56%

Total

9.96

69

1.79

0.80

18%

26%

 

 

See all NSW Department of Education data standards