Data tokenisation is the replacement of a sensitive value, such as a bank account number, with a token: a stand-in value that has no meaning on its own. The real value is kept in one protected place, and only a few approved systems may swap the token back for it. Swapping it back is called detokenisation. The general idea is explained on the tokenisation page. This page is about how companies apply it to their own databases.
Imagine an electricity distribution company, or discom, in Bhopal with 18 lakh customers. Its database holds many customers' bank account numbers, because they pay their bills by auto-debit. The account numbers are copied into the billing system, the analytics system, the call-centre software and the test databases. Every copy is one more place from which they can leak.
Tokenisation removes the real numbers from all those copies. Say a customer's account number is 50100234567812. The tokenisation software replaces it with 50100918273645. The token has the same length and format as an account number. So the billing and analytics software keep working without any change, because the field still looks like an account number. This is called format-preserving tokenisation.
The same account number always becomes the same token. So analysts can still count customers, join tables and find duplicate accounts, using tokens alone. Only the auto-debit system, which must send the real account number to the bank, may detokenise, and each detokenisation is recorded. If an attacker steals the analytics database, he gets 18 lakh tokens and no account numbers.
There are two designs. In a vault design, the software keeps a table that links each token to its real value, in a locked database called a token vault. In a vaultless design, the token is calculated from the real value with a secret key. No table is needed, so the system is faster at large scale.
How does tokenisation differ from encryption? Encrypted data can be decrypted by anyone who gets the key. A vault token has no mathematical link to the real value, so without the vault it is just a number. A token also usually keeps the size and format of the original, while the result of ordinary encryption does not.
To know which fields to tokenise, the company uses the labels from data security posture management (DSPM). Tokens are also used before data reaches an AI model, so that the model and the LLM guardrails around it work with tokens instead of real values. Payment cards in India are also tokenised under RBI rules, but by the card networks and the banks that issue the cards. That is a separate system, run for payments only.