Statistical disclosure control (SDC) seeks to modify statistical data so that they can be published without giving away confidential information that can be linked to specific respondents. The challenge for SDC is to achieve this modification with minimum loss of the detail and accuracy sought by database users. SDC methods for microdata are usually known as masking methods, of which there is a wide range. From the point of view of their operational principles, current masking methods fall into the following two categories (Willenborg and De Waal 2001):• Perturbative. The microdata set is distorted before publication. In this way, unique combinations of scores in the original dataset may disappear and new unique combinations may appear in the perturbed dataset; such confusion is beneficial for preserving statistical confidentiality. The perturbation method used should be such that statistics computed on the perturbed dataset do not differ significantly from the statistics that would be obtained on the original dataset.• Nonperturbative. Nonperturbative methods do not alter data; rather, they produce partial suppressions or reductions of detail on the original dataset. Global recoding, local suppression, and sampling are examples of nonperturbative masking.

0 Some of the work reported in this chapter was funded in part by the US Bureau of the Census under Contracts No. OBLIG-2000-29158-0-0 and OBLIG-2000-29144-0-0. Thanks go to Laura Zayatz for providing information on rank swapping. We would also like to thank Josep M. Mateo-Sanz and Francesc Sebé for their help in working out some of the examples in this chapter. The comments of the editors and several reviewers are gratefully acknowledged as well.