Tokenisation

Tokenisation substitutes a sensitive value (a credit card number, a PAN, a government ID) with a token that preserves the shape and format but has no mathematical relationship to the original. The real value lives in a hardened tokenisation vault, and services that do not need the real value only see the token. For payment data this is the PCI DSS-recommended pattern — most of the merchant stack handles tokens, and only the payment gateway de-tokenises at the point of charge.

For privacy purposes, tokenisation is a pseudonymisation technique: the token is still personal data because the vault can reverse it, but the data environment outside the vault is substantially de-risked. GDPR Article 32 cites pseudonymisation as a safeguard, and DPDP Section 8(5)'s 'reasonable security safeguards' is satisfied in part by broad tokenisation of sensitive fields. The practical gain is that a breach of a tokenised data store exposes tokens, not plaintext — and under the right conditions (strong key management, no vault compromise) does not require individual notification under GDPR Article 34(3)(a).