Data Masking & Data Classification in Salesforce: A Complete Guide

In today’s digital world, data is the new oil — and protecting it is critical for both compliance and trust. Salesforce, being a customer-centric platform, provides robust tools to safeguard sensitive data. Two of the most powerful features in this area are Data Masking and Data Classification.

This blog will walk you through what they are, why they matter, and how to implement them effectively in Salesforce.

What is Data Classification in Salesforce?

Data classification is the process of categorizing your Salesforce data based on its sensitivity and compliance needs. It helps admins and security teams understand which data is confidential, internal, or public, and apply appropriate security controls.

Salesforce provides built-in fields for classification at the metadata level (field-level security).

Types of Data Classification in Salesforce:

Data Sensitivity Level
- Confidential: Highly sensitive (e.g., Social Security Numbers, Credit Card Numbers)
- Restricted: Business-critical (e.g., Contract Details, Financial Data)
- Internal: Only for employees but not sensitive
- Public: Safe to share
Data Classification Category
- Personal Data (PII)
- Health Data (HIPAA)
- Financial Data
- Operational Data
Compliance Categorization
- GDPR
- HIPAA
- CCPA
- Custom Compliance Labels

💡 Example: You can classify a “National ID” field as Confidential → Personal Data → GDPR.

What is Data Masking in Salesforce?

Data masking is the process of hiding or obfuscating sensitive data to prevent exposure in non-production environments (like sandboxes).

This is especially important because developers, testers, and admins often work in sandboxes that should not contain real customer data. Data Masking ensures that while the data looks realistic for testing, it doesn’t expose sensitive information.

Types of Data Masking:

Anonymization – Replaces data with unrelated but realistic values.
- Example: Replace John Smith with Alex Brown.
Pseudonymization – Replaces sensitive identifiers but keeps them unique.
- Example: Mask phone numbers as 999-XXX-XXXX but ensure uniqueness.
Redaction – Completely hides or blanks out sensitive data.
- Example: Replace an SSN 123-45-6789 with XXX-XX-XXXX.
Shuffling – Randomizes data within the same column.
- Example: Shuffle employee names within the dataset.

How to Implement Data Classification in Salesforce

Enable Data Classification Fields
- Go to Setup → Object Manager → Field → Set Field-Level Security.
- You’ll see classification fields like:
  - Compliance Categorization
  - Data Sensitivity Level
  - Data Owner
Classify Fields
- Open any custom/standard field.
- Assign Data Sensitivity (Confidential, Restricted, etc.).
- Assign Compliance Category (GDPR, HIPAA, etc.).
Audit Using Security Center or Health Check
- Run reports on classified fields.
- Identify which fields require extra security (encryption, FLS, etc.).

How to Implement Data Masking in Salesforce

Salesforce provides Data Mask, a managed package available for sandboxes.

Install Salesforce Data Mask (Add-on)
- Available for Enterprise, Performance, Unlimited, and Developer editions.
- Installed in Sandbox environments only.
Define a Data Masking Policy
- Select objects and fields to mask.
- Choose masking type (Anonymize, Pseudonymize, Redact, Shuffle).
Run the Masking Job
- Execute the policy.
- Sandbox data will be transformed into secure test data.
Test Your Applications
- Developers/testers can safely use masked data without risk of exposing PII.

Benefits of Data Masking & Classification

✅ Improved Security – Protects customer trust by safeguarding sensitive data.
✅ Compliance – Meets regulations like GDPR, HIPAA, and CCPA.
✅ Risk Mitigation – Prevents accidental data leaks in sandboxes.
✅ Better Governance – Helps security teams track where sensitive data exists.
✅ Realistic Testing – Developers can still test effectively without real data.

Best Practices

Always classify all custom fields during development.
Regularly review and update data classification as business needs evolve.
Apply Field-Level Security (FLS) + Shield Platform Encryption to confidential fields.
Never refresh sandboxes with real data unless masking is applied.
Train developers/testers on the importance of working with masked data.

Conclusion

Data Classification helps you identify and label sensitive data, while Data Masking ensures that data is protected in non-production environments. Together, they form a powerful shield against data leaks, compliance violations, and unauthorized access.