A privacy model that ensures each record in a dataset is indistinguishable from at least k-1 other records with respect to certain identifying attributes.