Data Masking

Overview

Data masking replaces real sensitive data with realistic but fake data, preserving format and structure. Essential for:

• Dev/staging environments: Use masked production data without exposing real PII
• Log sanitization: Prevent PII from appearing in log aggregation systems
• Analytics: Analyze behavioral patterns without raw PII
• Testing: Realistic test data that won't trigger real consequences

Instructions

1. Inventory where PII lives (tables, log fields, API payloads, exports) and classify it as direct identifiers or quasi-identifiers.
2. Pick the technique per use case from the table below; prefer irreversible masking for dev/staging and tokenization only where the real value must be recovered.
3. Mask at the boundary (export job, log formatter, API serializer), never in the consuming app.
4. Verify: scan the masked output with the patterns or Presidio and fail the pipeline on any hit.

Masking Techniques