What is personal data masking?
Personal data masking is the removal or replacement of identifying details before any content reaches a model. A direct identifier such as a name or an account number is substituted with a token the calling system can reverse, so the model receives only the masked form. The step belongs at the perimeter of the deployment rather than inside a prompt template.
Also called: Data masking, De-identification
Where the masking boundary is drawn, and why the position decides everything
The first question a data protection officer asks about an AI deployment is what leaves the institution and in what form. Masking answers it as a property of the architecture rather than as an assurance in a policy document. The point of application is what makes the claim verifiable, since anything applied inside a prompt template has already been composed with the real values. The boundary therefore belongs on the architecture diagram the organisation hands to its regulator.
- Masking reduces the data a model provider could ever hold, whatever the contract says.
- A reversible token lets the calling system restore identity after the model has answered.
- The position of the masking step is auditable in a way a policy commitment is not.
- Regulators examine where personal data travels rather than what a vendor promises about it.
How personal data masking works
- The identifier types in scope are agreed against the applicable data protection regime.
- Content is scanned for those types before any prompt is composed.
- Each detected value is replaced with a token held in a vault inside the boundary.
- The masked content reaches the model, which never receives the original value.
- Tokens in the response are resolved back to real values by the calling application.
- Detection coverage is measured on live traffic and the pattern set is revised.
How personal data masking is evaluated
Masking is assessed on what the detector misses rather than on what it catches. Measure the following against real traffic rather than a synthetic corpus:
- recall per identifier type on held out production samples
- residual identifiers found by a second detector on masked content
- false masking rate where a clinical or financial term resembles an identifier
- latency added by the masking step at peak volume
- coverage across every document format and channel accepted
Limitations, risks and common failure modes
- Free text carries identifiers in forms no pattern library anticipated.
- Masking is applied to the form fields and omitted from the attached document.
- Excessive masking removes the context an answer genuinely depends upon.
- A combination of quasi-identifiers re-identifies a person after direct identifiers have gone.