What is the recommended approach to masking sensitive data when sharing with external parties?

• A. Mask sensitive fields in shared datasets.
• B. Share full PII for accuracy.
• C. Rely only on encryption at rest.
• D. Never mask PII under any circumstances.

Answer: (A)

Masking sensitive fields in shared datasets is the recommended approach when giving external parties access to data. By obscuring PII, you protect individuals’ privacy while keeping the data’s structure and usefulness intact for legitimate analysis or testing. Techniques like static data masking (creating a non-real copy for sharing) or dynamic masking (on-the-fly concealment as data is accessed) help preserve formats and referential integrity, so recipients can work with realistic-looking data without seeing actual values. Relying only on encryption at rest doesn’t address risk once the data is shared or in transit, because once someone has access, encrypted data can still reveal sensitive information if not masked. Sharing full PII is unnecessary and increases privacy and regulatory risk, and never masking PII is clearly unsafe.