backend-data-masking

Backend Data Masking

Purpose

Protect personally identifiable information (PII) using masking, encryption, tokenization, and anonymization techniques for GDPR/CCPA compliance.

Agent Protocol

Trigger

Exact user phrases: "data masking", "PII", "personally identifiable information", "encryption", "anonymization", "GDPR", "CCPA", "data privacy", "field-level encryption", "tokenization", "redaction", "data classification", "mask sensitive data".

Input Context

• Data model — which fields contain sensitive data.
• Classification of each field (PII, PCI, PHI, internal).
• Regulatory requirements (GDPR, CCPA, HIPAA, PCI-DSS).

Output Artifact

Data masking configuration or implementation code. No file unless requested.

Response Format

Field: {field name}
Classification: {PII|PCI|PHI|Internal}
Protection: {mask|encrypt|tokenize|anonymize|redact}

Completion Criteria

• All sensitive fields identified and classified.
• Protection strategy chosen per classification.
• Masking/encryption implemented at the application or database layer.
• Audit log of data access recorded.
• Right-to-deletion workflow for GDPR Article 17.

Max Response Length

3 lines per field. 15 lines for full plan.

Architecture Decision Tree

Which Protection Strategy?

Is the data needed for business operations?
  ├── Yes → Does the business need the original value?
  │         ├── Yes → Encrypt (symmetric or asymmetric)
  │         └── No → Tokenize (map to surrogate value)
  ├── No → Is the data needed for display/UI?
  │         ├── Yes → Mask on read (partial display)
  │         └── No → Is the data needed for analytics?
  │                  ├── Yes → Anonymize (statistically useful, not reversible)
  │                  └── No → Redact (remove entirely)

Where to Apply Protection?

Is the data at rest in a database?
  ├── Yes → Field-level encryption OR tokenization at write time
  ├── No → Is the data in transit in an API response?
  │         ├── Yes → Mask or redact at the presentation layer
  │         └── No → Is the data in logs?
  │                  ├── Yes → Redact entirely — never log PII
  │                  └── No → Is the data in a backup/export?
  │                           ├── Yes → Anonymize or encrypt
  │                           └── No → Apply at the closest boundary