Masked Data

Masking replaces part or all of a sensitive field with a placeholder value. Static masking modifies the stored value irreversibly (useful for non-production datasets used in development and testing). Dynamic masking modifies the value at read time based on the viewer's role (useful for production systems where some users need the full value and others need a redacted one). Format-preserving masking retains the shape of the original (so masked payment card numbers still pass validation) which lets masked data flow through unmodified downstream systems.

Masking is not encryption and not anonymisation. Dynamic masking is reversible for users with the right role; static masking may be reversible depending on the technique. For privacy purposes, the key test is whether the data remains personal data in the hands of the viewer. A support agent who sees a dynamically masked card number cannot identify the cardholder from that view, but the underlying record is still personal data in storage, and all the DPDP / GDPR / PDPA duties attach to it.