Masking PII/PCI/PHI data on Prod environment

[#1]

Description - Need a way to mask PII data for developers for the production environment, for better data protection.

Why is this feature important to you - Security of the data! Although there will be limited users on Prod, however, we cannot avoid the support team or developers being added to Prod for various activities.

How would you like the feature to work - A user permission mapped with labels/policies to hide or mask the data on the environment.

Current Behaviour - PII data can be easily viewed today, so we need a better way to make it even more secure.

[#2]

https://experienceleague.adobe.com/docs/platform-learn/tutorials/admin/configure-attribute-based-acc... -> this is same as what I posted out. So finally we have this feature available now.

[#3]

Does attribute-based access control restrict data access via query service also? Looking at video.. data restriction is possible via UI. 

[#4]

I haven't tried that out @Anuhya-Y, but I would assume it would support. The video shows permissions being managed for query service as well.

[#5]

How does the data masking work? For instance, if an agreement ID appears as ABD97998, one masking approach would be to convert it to XXXXX998. Is the masking done only for user so they see masked data while the field itsels contains original data, that can be used by AEP?

[#6]

@ChetanyaJain 

Are you request to data be masked for users with specific roles?  Currently the attribute access control restricts the viewing of a data attribute for specific users.  

https://experienceleague.adobe.com/docs/platform-learn/tutorials/admin/configure-attribute-based-acc...

Are you looking to have the field be available, but not the data be masked for specific users?

Is the data to be masked to the destination as well?

[#7]

Let me try to clarify my question, as I am

not technical at all. I am trying to understand the right way to manage sensitive data. Client wants to upload financial client data to AEP. We can allow that only if data is masked for privacy and security reasons. My question is: dies the client mask the data befotr sendung it to AEP? Or do they send the data and AEP offers dynamic data masking capability?