Controllers must take reasonable measures to ensure deidentified data can’t be associated with an individual, publicly commit to maintaining and using this data without attempting to re-identify the data, and contractually obligate recipients to comply with the regulations.