Differential Privacy
A mathematical guarantee that a result barely changes whether or not any one person's data was included.
Differential privacy adds calibrated noise so that individual records cannot be reverse-engineered from outputs, with a tunable privacy budget quantifying the guarantee. Unlike anonymisation, it is a proof rather than a hope. The cost is accuracy, and the budget is finite across queries.
In practice: Publishing aggregate statistics that cannot be used to identify any single respondent.