Data Masking vs Redaction: What Is the Difference?1

Both hide sensitive data. Masking changes how a value looks or replaces it with a stand-in, usually inside systems and databases. Redaction removes information from a document before it is shared. This guide explains the difference with official definitions and a table for choosing.

Reviewed by the Re-Doc team. Last reviewed: 29 October 2026. General information, not legal advice.

The short answer

Data masking hides or replaces values so that people and systems can keep working with data without seeing the real thing. It is most common inside databases, applications, test environments and screens.

Redaction removes information from a document or dataset before it leaves your hands, for example before a court filing, a public records release or sending a file to a third party.

So the practical difference is where they are used and what the output is for. Masking keeps a working copy of data usable. Redaction produces a document that is safe to release.

Official definitions

The clearest definitions come from the US National Institute of Standards and Technology (NIST), which uses both terms in its de-identification guidance.

• Redaction, from NIST SP 800-188: "The removal of information from a document or dataset for legal or security purposes."
• Masking, from NIST SP 800-188 and NISTIR 8053: "The process of systematically removing a field or replacing it with a value" in a way that does not preserve the analytic utility of the value. NIST's examples are replacing a phone number with asterisks or with a randomly generated pseudonym.

The payment card industry uses a narrower meaning. The PCI Security Standards Council glossary defines masking as a "Method of concealing a segment of PAN when displayed or printed", which is why receipts show only the last four digits of a card number.

Side by side

How masking works in practice

Masking comes in a few common forms:

• Character masking: showing only part of a value, such as the last four digits of a card or an account number.
• Substitution: replacing real values with realistic fake ones, so a test database still has names and phone numbers that look real.
• Static masking: creating a separate, permanently masked copy of a database, often for developers and testers.
• Dynamic masking: hiding values on the fly for users who should not see them, while the stored data stays unchanged.

The last point matters. With dynamic masking, the real data is still there, and anyone with the right access can see it. That is useful for access control, but it is not the same as removing the data.

How redaction works in practice

Redaction is usually applied to documents: contracts, medical records, discovery productions, police reports, tax forms and public records requests.

The classic failure is cosmetic redaction, where someone draws a black rectangle over text in a PDF. The words stay in the file underneath and can be copied out. Proper redaction removes the text itself, or for scanned pages, writes the black box into the image so nothing remains below it. A quick check after any redaction: select the black area, copy it and paste it into a text editor. If words appear, the data is still there.

Where masking and redaction overlap: synthetic replacement in documents

There is a middle ground that people often call masking when it is applied to documents: replacing each sensitive value with a realistic synthetic one, and keeping the rest of the document as it is.

For example, "Priya Sharma, account 0041 7720 9913" becomes "Anjali Mehta, account 0083 1456 2207". The document still reads naturally, tables still line up, and the same person gets the same replacement everywhere. This keeps a document useful for review, analytics or AI work, while the real values are gone. It is the document version of substitution masking.

Whether the result counts as anonymized depends on how it was done. Under the GDPR, data that can still be linked back to a person with separately kept information is pseudonymized, not anonymized (GDPR Article 4(5)). Under HIPAA, de-identified health information is information where there is "no reasonable basis to believe that the information can be used to identify an individual" (45 CFR 164.514(a)). If you keep a mapping table from fake values back to real ones, treat the output as pseudonymized and protect the table.

For the wider picture, read our guide to redaction vs anonymization vs pseudonymization.

Which one should you use?

How Re-Doc handles documents

Re-Doc works on documents rather than databases. It finds personal data in PDFs, Word files, text files, scans and photos. Scanned pages and images get permanent black-box redaction. Text-based PDF, DOCX and TXT files get synthetic replacement with the layout kept, and text files can also use labels such as [PERSON_NAME] or block characters instead. Every change is highlighted for review before download, scanned pages can be corrected in the editor, and text files can be edited directly. You can try it free on your first 10 pages, or read step-by-step redaction guides for common documents such as bank statements, W-2s and medical records.

Frequently asked questions

Is data masking the same as redaction?

No. Masking hides or replaces values, usually so data stays usable inside systems. Redaction removes information from a document or dataset before it is shared or released.

Is masked data anonymized?

Not necessarily. If the masking can be reversed with a key or lookup table, or if the real data is still stored and only hidden on screen, it is not anonymized. NIST's definition describes masking as replacing a value in a way that does not keep its analytic utility, but whether a dataset is anonymous depends on the whole dataset and who can access the key.

Is redaction reversible?

Proper redaction is not reversible, because the information is removed. Cosmetic redaction, where a black box is drawn over text that is still in the file, can be reversed by copying the text out.

Which is better for documents?

For a document you must release with parts withheld, use redaction. For a document people still need to read and use, synthetic replacement keeps it readable while removing the real values.

What is the difference between data masking and data redaction in PCI DSS?

In the PCI glossary, masking means concealing part of a card number when it is displayed or printed. Removing card data entirely from a document or system is closer to redaction or deletion.

Sources

1. NIST CSRC Glossary, "redaction" (NIST SP 800-188): https://csrc.nist.gov/glossary/term/redaction
2. NIST CSRC Glossary, "masking" (NIST SP 800-188, NISTIR 8053): https://csrc.nist.gov/glossary/term/masking
3. PCI Security Standards Council Glossary, "masking": https://www.pcisecuritystandards.org/glossary/masking/
4. GDPR Article 4, definitions (pseudonymisation, Article 4(5)): https://gdpr-info.eu/art-4-gdpr/
5. 45 CFR 164.514, de-identification of protected health information: https://www.law.cornell.edu/cfr/text/45/164.514