Data masking is a data transformation method used to protect sensitive data by replacing it with a non-sensitive substitute. Often the goal of masking data is to allow the use of realistic test or demo data for development, testing, and training purposes while protecting the privacy of the sensitive data on which it is based.

Data masking can be done in a variety of ways, both in terms of the high-level approach determined by where the data lives and how the end user needs to interact with it, and in terms of the entity-level transformations applied to de-identify the data. In this guide, we’ll provide definitions of both the high-level approaches to masking data, as well as the types of data masking techniques used to achieve masked data at the entity level.

## Approaches to data masking

Data masking can be achieved by way of three primary high-level approaches. These approaches differ based on where the data is stored and functional requirements of the masked output data.

### Static data masking

Static data masking is masking performed on data at rest (aka data in a data store), and the process is designed to permanently replace sensitive data with non-sensitive substitutes. This approach creates data that is read/write, an essential quality for [test data for software](https://www.tonic.ai/guides/guide-to-test-data-management) development and QA teams. Static data masking may be performed on a traditional relational database, such as a [PostgreSQL test database](https://www.tonic.ai/blog/how-to-create-realistic-test-data-for-postgresql), in a NoSQL database like [MongoDB](https://www.tonic.ai/blog/how-to-mask-data-for-testing-in-mongodb), or on file-based data like CSV or JSON files.

### Dynamic data masking

Dynamic data masking is masking performed on data in transit by way of a proxy. This process is designed to leave the original at-rest data intact and unaltered. The masked data isn’t stored anywhere and is read-only.

### On-the-fly data masking

To a certain degree, on-the-fly data masking can be thought of as a combination of the dynamic and static methods. It involves altering sensitive data in transit before it is saved to disk.

## Data masking techniques

Within each of the above high-level approaches, a variety of transformation techniques can be applied to the data to achieve a masked output dataset. When it comes to masking data, here are a few of the more common techniques:

- **Redaction**: Removing or obscuring confidential information from a document or record.
- **Scrambling**: Rearranging data in a way that makes it difficult to read or interpret.
- **Shuffling**: Rearranging values within a column to ensure realism while protecting privacy.
- **Substitution**: Replacing sensitive data with similar but non-sensitive data.
- **Encryption**: Converting data into a code that can only be read by someone with the encryption key.

An illustrative example of format-preserving encryption

## Common use cases for data masking

Many teams in an organization can benefit from data masking to ensure data privacy while simplifying access to quality data to fuel productivity. Here are several common use cases for masking data in today’s companies.

### Software testing and QA

Organizations need usable [test data](https://www.tonic.ai/guides/guide-to-test-data-management) that represents production as closely as possible for testing and QA.

### Software development

Developers typically work in their own ‘sandbox’ or development environment and need manageable datasets to work with for validating their work.

### Sales demos and customer onboarding

Demos and training require realistic data that does not compromise sensitive information. Masking data ensures quality datasets for these scenarios.

### Data analytics

Masking data by way of [tokenization](https://www.tonic.ai/guides/data-masking-vs-tokenization-finding-the-differences) eliminates all PII/PHI/sensitive data and allows for compliant long-term data storage.

### Off-shore teams

Data masking allows organizations to share masked data with vendors without compromising security.

## Pros and cons of data masking

| Pros of data masking | Cons of data masking |
| --- | --- |
| - Ensures access to safe, useful data for a variety of teams | - Not an easy solution to build in-house |
| - Streamlines workflows and team productivity | - Requires maintenance over time |
| - Enables global organizations in granting data access | - May make it difficult to perform certain types of analysis |
| - Protects sensitive data from unauthorized access |  |

## Data masking best practices

Integrating masking into your sprint means building a workflow that’s both agile and resilient. Here are the core steps:

1. **Identify sensitive data**  
2. **Determine appropriate techniques**  
3. **Configure relationships and consistency**  
4. **Configure destination settings**  
5. **Generate and validate**

## How to implement data masking in your organization

Implementing data masking is crucial for ensuring the safety of sensitive data while complying with legal regulations like [GDPR](https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en) and [HIPAA](https://www.hhs.gov/hipaa/index.html).

Implementing data masking techniques can protect sensitive data from unauthorized access and comply with industry regulations, ensuring the safety of your organization's information.

[Chiara Colombi](https://www.tonic.ai/authors/chiara-colombi)  
Director of Product Marketing