A method, carried out by a computer program, for de-identifying data of a plurality of data fields, the method comprising the steps of: - receiving data of an entity comprising a plurality of data fields of data to be de-identified; - determining an entity key for said entity; - generating, for each data field, a data field-specific encryption key based on metadata of that data field and said entity key; - generating, for each data field, a data field-specific randomization value based on metadata of that data field; - encrypting, for each data field, said data field-specific randomization value by means of said data field-specific encryption key; - generating, for each data field, de-identified entity data from said received entity data using said encrypted data field-specific randomization value; and - storing said entity key, said data field-specific encryption keys and said encrypted data field-specific randomization values; and wherein the step of generating, for each data field, de-identified data from said received entity data using said encrypted data field-specific randomization value, further comprises the step of: - determining, for each data field, if said received entity data of said data field is to be normalized (S6A) by adjusting the entity data to a value within a predetermined range for that specific data field; randomized via a field-specific list (S6B) by substituting the received data of that data field by a text string from the field-specific list, wherein said text string is randomized using said encrypted data field-specific randomization value; or randomized via a set of field-specific format rules (S6C) by substituting a part of the received entity data of that data field using said data field-specific randomization value and determining, based on the substituted part of the received entity data of that data field a checksum that fulfils said set of field-specific format rules. - receiving data of an entity comprising a plurality of data fields of data to be de-identified; - determining an entity key for said entity; - generating, for each data field, a data field-specific encryption key based on metadata of that data field and said entity key; - generating, for each data field, a data field-specific randomization value based on metadata of that data field; - encrypting, for each data field, said data field-specific randomization value by means of said data field-specific encryption key; - generating, for each data field, de-identified entity data from said received entity data using said encrypted data field-specific randomization value; and - storing said entity key, said data field-specific encryption keys and said encrypted data field-specific randomization values; and wherein the step of generating, for each data field, de-identified data from said received entity data using said encrypted data field-specific randomization value, further comprises the step of: - determining, for each data field, if said received entity data of said data field is to be normalized (S6A) by adjusting the entity data to a value within a predetermined range for that specific data field; randomized via a field-specific list (S6B) by substituting the received data of that data field by a text string from the field-specific list, wherein said text string is randomized using said encrypted data field-specific randomization value; or randomized via a set of field-specific format rules (S6C) by substituting a part of the received entity data of that data field using said data field-specific randomization value and determining, based on the substituted part of the received entity data of that data field a checksum that fulfils said set of field-specific format rules.