Abstract: This disclosure relates to protecting an input dataset against linking with further datasets. A processor of a computer system calculates multiple values of one or more parameters of a perturbation function, the perturbation function being configured to perturb the input dataset to protect the input dataset against linking with further datasets, each of the multiple values of the one or more parameters of the perturbation function indicating a level of protection against linking with further datasets. The processor then generates multiple derived datasets from the input dataset and calculates, for each of the multiple derived datasets, a utility score that is indicative of a utility of the derived dataset for a desired data analysis. The processor then outputs one of the multiple derived datasets that has the highest utility score.