Data Masking (Dynamic Data Masking)

Dynamic Data Masking (DDM) is a SQL Server feature that limits exposure of sensitive data by masking it at query time for unauthorized users. It doesn’t alter the actual data in the table but controls how it’s presented to certain users or roles.

Introduced in SQL Server 2016, DDM simplifies application logic and increases security compliance. For example, a credit card column might display only the last four digits (XXXX-XXXX-XXXX-1234) to non-privileged users.

Types of masks include:

• Default (entirely obfuscates value)
• Email (hides part of email addresses)
• Partial (reveals a prefix/suffix)
• Random (for numeric types)

Dynamic Data Masking is easy to implement using the MASKED WITH clause during column definition or ALTER TABLE. However,it should be noted that DDM is a presentation-layer feature—it doesn’t encrypt or redact data in logs or backups.

It’s an excellent lightweight tool for enhancing data privacy in test environments and user-facing apps, especially in regulated industries.