A method, carried out by a computer program , for de-identifying data of a plurality of data fields, the method comprising the steps of: - receiving (S1) data of an entity comprising a plurality of data fields of data to be de-identified; - determining (S2) an entity key for said entity; - generating (S3), for each data field, a data field-specific encryption key based on metadata of that data field and said entity key; - generating (S4), for each data field, a data field-specific randomization value based on metadata of that data field; - encrypting (S5), for each data field, said data field-specific randomization value by means of said data field-specific encryption key; - generating (S6), for each data field, de-identified entity data from said received entity data using said encrypted data field-specific randomization value; and - storing (S7) said entity key, said data field-specific encryption keys and said encrypted data field-specific randomization values; and wherein the step of generating (S6), for each data field, de-identified data from said received entity data using said encrypted data field-specific randomization value, further comprises the step of: - determining, for each data field, if said received entity data of said data field is to be normalized (S6A) by adjusting the entity data to a value within a predetermined range for that specific data field; randomized via a field-specific list (S6B) by substituting the received data of that data field by a text string from the field-specific list, wherein said text string is randomized using said encrypted data field-specific randomization value; or randomized via a set of field-specific format rules (S6C) by substituting a part of the received entity data of that data field using said data field-specific randomization value and determining, based on the substituted part of the received entity data of that data field a checksum that fulfils said set of field-specific format rules. - receiving (S1) data of an entity comprising a plurality of data fields of data to be de-identified; - determining (S2) an entity key for said entity; - generating (S3), for each data field, a data field-specific encryption key based on metadata of that data field and said entity key; - generating (S4), for each data field, a data field-specific randomization value based on metadata of that data field; - encrypting (S5), for each data field, said data field-specific randomization value by means of said data field-specific encryption key; - generating (S6), for each data field, de-identified entity data from said received entity data using said encrypted data field-specific randomization value; and - storing (S7) said entity key, said data field-specific encryption keys and said encrypted data field-specific randomization values; and wherein the step of generating (S6), for each data field, de-identified data from said received entity data using said encrypted data field-specific randomization value, further comprises the step of: - determining, for each data field, if said received entity data of said data field is to be normalized (S6A) by adjusting the entity data to a value within a predetermined range for that specific data field; randomized via a field-specific list (S6B) by substituting the received data of that data field by a text string from the field-specific list, wherein said text string is randomized using said encrypted data field-specific randomization value; or randomized via a set of field-specific format rules (S6C) by substituting a part of the received entity data of that data field using said data field-specific randomization value and determining, based on the substituted part of the received entity data of that data field a checksum that fulfils said set of field-specific format rules. <EOS>