Standard masking policies
Use the standard masking policy reference topics to understand the behavior, input requirements, processor options, and known limitations for each standard masking policy available in IBM® Optim Data Privacy.
Standard masking policies are organized into data categories. Each category groups policies that target a related class of sensitive data. When you configure a masking definition, you select a data category, a data format type within that category, and a processor type that determines how the masked value is derived.
The following data categories are available:
- Address
- Credit card
- Device and network address
- Financial information
- Healthcare information
- Person name
- Personal information
Common behavior across all policies
The following behaviors apply to all standard masking policies regardless of data category or processor type:
- A NULL input always produces a NULL output. No masked value is generated and no error is raised.
- The
configparameter accepts an empty object ({}) or can be omitted entirely for all processors, unless a specific policy reference topic states otherwise. - Output length always equals input length for valid input, unless a specific policy reference topic states otherwise.
Choosing a processor
Every standard masking policy supports the same 4 processor types. The processor you choose determines whether the output is random or deterministic, and whether it is stable across job runs. Use the following descriptions to select the processor that matches your requirements.
FormatPreservingRedactionProcessor- Replaces sensitive segments with the lowest-rank character in each segment's character-set domain, producing the same canonical output for every input that shares the same preserved segments. Use this processor when you need uniform suppression of sensitive values and do not need to distinguish between different source values in the output.
RandomFormatFabricationProcessor- Generates a freshly randomized value on every invocation. The output is non-deterministic — the same input produces a different output on every run. Use this processor for non-key columns where run-to-run or row-to-row consistency is not required.
FormatPreservingTokenizationProcessor- Produces a deterministic token derived from the input value and the job initialization vector (IV). The same input always produces the same output for the same IV. Use this processor when the same source value must consistently map to the same masked value within a job run.
RepeatableFormatFabricationProcessor- Produces a deterministic fabricated value that is stable across all invocations and job restarts. The same input always produces the same output regardless of when or how many times the job runs. Use this processor for primary-key and foreign-key columns where referential integrity must be maintained across tables and job runs.