Data Masking.

Replacing sensitive data with realistic but fictitious values so that downstream users, applications, or environments can use the data without exposing the originals. It belongs to the Privacy & Data Protection category of cybersecurity.

Replacing sensitive data with realistic but fictitious values so that downstream users, applications, or environments can use the data without exposing the originals.

Data masking transforms sensitive fields — names, IDs, payment details, health values — into structurally valid but non-sensitive substitutes that preserve format, type, and statistical utility. Static masking writes masked copies into test, training, or analytics datasets, while dynamic masking applies on-the-fly transformations based on user role at query time. Common techniques include substitution from lookup tables, shuffling, character scrambling, nulling, and format-preserving encryption. Masking does not replace true anonymization or differential privacy for public releases, but it is a workhorse control for software testing, vendor enablement, and least-privilege access. It is referenced in PCI DSS Requirement 3.4, HIPAA Safe Harbor, and ENISA guidance.

Defences for Data Masking typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Data Obfuscation, Static / Dynamic Masking.