What are the steps of a re-identification risk-assessment methodology?

Identify assets → analyze threats → calculate risk → implement controls → monitor & review — a continuous cycle.

A structured, repeating risk-assessment loop:

1. Identify assets — catalog the sensitive attributes and quasi-identifiers you hold.
2. Analyze threats — model attacker capabilities and motivations (the attacker model).
3. Calculate risk — quantify the likelihood and impact of re-identification.
4. Implement controls — deploy appropriate anonymization and access restrictions.
5. Monitor & review — continuously assess effectiveness and adapt to new threats.

It's a cycle, not a one-shot: because external data and attack techniques keep evolving, the loop must run continuously.

Tip: Notice step 2 (threat model) comes before step 4 (controls) — you can't choose k, l, or ε without first deciding who you're defending against.