Data protection is the group of methods that let a company keep using sensitive data without exposing it. There are three main methods. Encryption scrambles the data. Tokenisation swaps the real value for a stand-in value. Masking hides part of the value. The software that applies these methods is also called data-centric security.
Why not simply lock the data away? Because the business needs it. Bills must be sent to real phone numbers. Analysts must count customers. Support staff must confirm who is calling. So the data must be used, and these methods decide how much of it each person or system actually sees.
Take, for example, a chain of diagnostic labs in Thiruvananthapuram. One patient record holds a name, a phone number, an Aadhaar number, the card number used for payment and the test results. Each field is handled differently.
The whole database is encrypted on disk. If someone steals a disk or a backup, they see only scrambled bytes. The key that unscrambles the data is kept separately, by encryption key management.
The card number and the Aadhaar number are replaced by tokens. A token is a stand-in value with the same format, which is useless outside the lab's own systems. The real values are kept in one locked store. This is data tokenisation. Card payments in India already work in a similar way. Since October 2022, RBI rules have not allowed online merchants to store customers' full card numbers, so card tokenisation is now standard.
The phone number is masked for the front-desk staff, who see 98XXXXXX21. That is enough to confirm the caller, but not enough to copy the number. This is data masking.
So which method suits which field? Encryption suits data that only systems need to read in full, such as a whole database or its backups. Tokenisation suits values that other systems need to match or count without seeing them, such as an Aadhaar or card number. Masking suits data that people need to recognise, but not read in full.
A newer use is AI. Before a patient's question is sent to an AI chatbot, the masking software replaces the name and phone number with placeholders, so the AI model never receives them. This works together with LLM guardrails. A fourth method protects data while a program is working on it: confidential computing runs the program inside a locked area of the processor. To know which fields need protection, all these tools use the labels from data security posture management (DSPM).