What is data masking?
Definition
Data masking is replacing real values in a data set, such as a phone number or name, with substitutes like asterisks or a random pseudonym, so the real information is hidden but the data stays usable in form.
- Category
- Data
- Also called
- masking, data obfuscation, data obscuring
- Last updated
NIST's glossary describes masking as "the process of systematically removing a field or replacing it with a value in a way that does not preserve the analytic utility of the value". The example it gives is replacing a phone number with asterisks or with a random pseudonym.
In plain terms, masking hides the real details but keeps the record in place. A card number shown as "** ** 4242" is a familiar case. A support agent can see enough to identify the card without seeing the whole number.
Where masking is used
Companies mask data when real details aren't needed. A developer testing an app can work with a copy of a customer database where names and phone numbers have been swapped for made-up ones. A call centre screen can hide most of an account number.
NIST also lists a related term, obscured data: data distorted by cryptographic or other means to hide information, also described as masked or obfuscated.
Why it matters to you
When a company masks your details in the places that don't need them, there are fewer copies of your real information to leak. If a test copy or a report is exposed in a breach, masked data is far less useful to an attacker than the real thing.
Masking vs. related terms
- Encryption scrambles data so it can be read again with a key. Masking replaces it for people who shouldn't see the original.
- Anonymization removes the link to a person so the data can't be tied back to them.
- De-identification strips identifying details from a record.
How to protect yourself
- 1
Share less in the first place
Masking happens on the company's side. What you control is what you hand over. Give only the details a form really needs.
- 2
Look for masked card and account numbers
Reputable services show only the last few digits of a card or account number. If a site displays the full number, be careful.
- 3
Read how a company handles your data
The privacy policy should say whether it limits who sees your personal details. Look for words like masked, pseudonymised or anonymised.
- 4
Remove what is already public
Masking won't help with data already listed on people-search sites. Serus finds where your address and phone number are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is data masking the same as encryption?
No. Encryption can be reversed with the right key. Masking replaces the value for the people who see it, so they never see the original.
Is masked data personal data?
It depends on whether the person can still be identified from what remains. Fully masked values with no link back are different from data where a key to the originals still exists.
What is an example of data masking?
Showing a phone number as asterisks or replacing a customer name with a random one in a test database.
Sources
Something wrong or out of date? Tell us and we'll re-check it.