There is provided a computer-implemented method for secure linking of anonymized data among computer domains, comprising: at each computer domain at which a data set including a number of data records is stored: identifying a sensitive data element within a data record; applying a cryptographic hash function to the sensitive data element so as to yield a token; replacing the sensitive data element with the token within the data record to yield an anonymized data record of the data set; and transferring to a server computer the anonymized data record of the data set; and at the server computer: iteratively transforming the tokens of the anonymized data records of each data set to yield a compounded token for each token; and linking the anonymized data records if their compounded tokens match.