Designs pseudonymized data models, aggregation rules, and controls on analytical outputs. Evaluates disclosure risk under the agreed threat model, including sparse groups and repeated queries. Produces documented privacy and utility evaluations at defined milestones.