You seem to be asking a managerial/policy question phrased like a data-science question. The policy question is "how do I keep customer data private from internal data scientists without harming its usability".
The data-science question is something like "how do I transform data so that the privacy and identifiability of its original form can not be deduced, while not disabling other analytical processes". This is the seed of the zero-information paradox.
I think your policy-person is asking a question equivalent to "how do I make my computer hacker-proof", where the only perfect answer is not to have the computer. There are going to be levels of "resistant" but there is no such thing as "hacker-proof".
One of the problems with this question is that vast majority of policy-asker specialized technical expertise is nearly nothing compared to the people you are trying to "selectively impede". Explaining an answer to them that they can understand might keep an idiot out, but doesn't actually stop data exfiltration.
Consider how data aggregation with cell phones works.
The many policy-folks asking the question can get an answer they think means "yes" when in fact it means "no", and a persistent of clever data person can figure it while the policy-person can't.
Lets make a process where we replace first name with a number. "Smith" becomes 1, "Jones" becomes 2, etcetera. Is that process reversible using only the output? Given only a list of numbers can I get back to the names? Yes, though it varies. If I look at the frequency of last names and compare them with number frequencies I should be able to do a decent job of de-anonymizing the common names. Saying this again, if 15% of last names are "Smith" and 15% of my output list of numbers are "1" then there is a really good chance that 1 means Smith.
That is a toy example, but the MAC address of your cell phone is known and sold. If all the data in the world is anonymized except the MAC, and I can go to a 3rd part and buy a list of MAC to identity mappings, then your data isn't anonymized at all. You missed the baby in that bathwater.