About data masking (ADPP add-on)

<body>
<p id="docs-hc-snippet" style="display: none;">The data masking feature, part of theAdvanced Data Privacy and Protection add-on, allows you to hide personally identifiable information (PII) from agents in custom and light agent roles.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_adpp">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Advanced Data Privacy and Protection (ADPP)</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Data masking lets you hide sensitive user info like names, emails, and phones from agents based on their roles, reducing exposure to personal data and supporting compliance with privacy regulations. It masks data in profiles, tickets, notifications, and knowledge management, while keeping the original data intact. Some agent actions are limited, and masking differs from redaction, which permanently removes data.</p>
</div>

<div class="body">

<p class="p">The data masking feature, part of the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6561144266906" target="_blank">Advanced Data Privacy and Protection add-on</a>, allows you to
hide personally identifiable information (PII) from agents in custom and light agent
roles. </p>
<p class="p">Data masking helps reduce unnecessary exposure to sensitive information by limiting the
data that agents can view. For example, a company collaborating with high-profile
clients may restrict access so that agents only see user data when it's required for
their role. This practice also supports compliance with regulations such as the General
Data Protection Regulation (GDPR), which emphasizes data minimization and controlled
access.</p>
<div class="p">This article includes the following topics:<ul class="ul" id="zug_data_masking__ul_dck_4mb_hdc">
<li class="li"><a class="xref" href="#topic_kll_qrj_1fc">Understanding data masking</a></li>
<li class="li"><a class="xref" href="#topic_d1c_vgm_tfc">Data masking limitations</a></li>
<li class="li"><a class="xref" href="#topic_pv5_5lv_bfc">Understanding the differences between data redaction and data masking</a></li>
</ul>
</div>
<p class="p">Related article:</p>
<ul class="ul" id="zug_data_masking__ul_skn_2ky_2hc">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/9368104312602" target="_blank">Turning on and configuring data
masking</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_kll_qrj_1fc">
<h2 class="title topictitle2" id="ariaid-title2">Understanding data masking</h2>
<div class="body">
<p class="p">Data masking allows admins to create and assign agents to custom and light agent
roles to determine which data is masked from agents.</p>
<p class="p">When a role is configured with data masking, agents see only the PII required for
their responsibilities, reducing the risk of unauthorized access. Masking is applied
at the presentation layer only, so PII in the database remains unchanged. Agents in
roles without masking continue to see all PII. When a role with masking settings is
saved, Zendesk automatically updates permissions to hide restricted PII. Agents
assigned to the masked role will see a lock icon next to any PII fields they are not
permitted to view.</p>
<div class="p">Data masking supports masking the following system fields in the Support and Guide
areas of Zendesk:<ul class="ul" id="topic_kll_qrj_1fc__ul_aqx_ldf_tgc">
<li class="li">Name</li>
<li class="li">Email</li>
<li class="li">Phone</li>
</ul>
</div>
<div class="p">The system fields listed above will be masked in the following areas of Zendesk
Support:<ul class="ul" id="topic_kll_qrj_1fc__ul_t3h_xfy_2hc">
<li class="li">End-user profile</li>
<li class="li">End-user fields in the context of a ticket (requester, CCs, followers)</li>
<li class="li">Email notifications</li>
<li class="li">Ticket views</li>
<li class="li">Support search</li>
<li class="li">Triggers and automations (business rules)</li>
<li class="li">Side conversations</li>
</ul>
</div>
<div class="p">For Knowledge, PII is masked from agents with permission to <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882-Creating-custom-roles-and-assigning-agents#:~:text=help%20center%20permissions.-,Manage%20Guide,-%3A%20Access%20the%20help" target="_blank">manage Guide</a>. This applies to:<ul class="ul" id="topic_kll_qrj_1fc__ul_ofm_2gy_2hc">
<li class="li">User segments</li>
<li class="li">User content</li>
<li class="li">Spam</li>
<li class="li">Community moderation views</li>
</ul>
</div>
<p class="p">Note that end-user data that has been made public will be visible to agents, even
with data masking in place. For example, if moderation is turned on and an end user
posts a public comment, their name won't be masked because it can be seen in the
help center.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_d1c_vgm_tfc">
<h2 class="title topictitle2" id="ariaid-title3">Data masking limitations</h2>
<div class="body">
<p class="p">Data masking may restrict certain agent actions that require access to PII. Features
such as managing end-user profiles will have certain functionality unavailable to
agents in roles with masking, such as the ability to delete and assume profiles, and
some tasks, such as managing suspended tickets, may be limited. Core workflows for
solving tickets remain unaffected.</p>
<p class="p"><strong class="ph b">General limitations</strong></p>
<ul class="ul" id="topic_d1c_vgm_tfc__ul_f1k_2hy_2hc">
<li class="li">Any functionality outside the scope described in <a class="xref" href="#topic_kll_qrj_1fc">Understanding data masking</a>, including QA, WFM, Talk,
and Explore, is not supported with masking.</li>
<li class="li">Zendesk recommends testing data masking in a <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6150628316058" target="_blank">sandbox environment</a>.</li>
</ul>
<p class="p"><strong class="ph b">Support limitations</strong></p>
<ul class="ul" id="topic_d1c_vgm_tfc__ul_sqf_khm_tfc">
<li class="li">Masking of PII in ticket comments is not yet supported.</li>
<li class="li">Managing organizations, managing suspended tickets, placeholders, legacy CCs,
print ticket, and View original email functionality is unavailable for masked
agents.</li>
<li class="li">
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/8037565521946" target="_blank">AI-generated ticket summaries</a> may
expose PII if turned on.</li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_pv5_5lv_bfc">
<h2 class="title topictitle2" id="ariaid-title4">Understanding the differences between data redaction and data masking</h2>
<div class="body">
<p class="p">Data redaction and data masking are both techniques used to protect sensitive
information, but they serve different purposes.</p>
<p class="p">Data redaction allows admins or <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank">agents in custom roles with permission</a> to permanently
remove sensitive information from tickets, ensuring that deleted data can't be
retrieved or viewed by any agents. Agents can <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408846470170" target="_blank">redact ticket content manually</a>, or with the Advanced
Data Privacy and Protection add-on, admins can create triggers to <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/9248330321050" target="_blank">automatically redact ticket data</a>.</p>
<p class="p">Data masking offers an alternative approach to protecting sensitive information. It
allows certain roles to have end-user names, email addresses, and phone numbers
obscured based on role settings. This means that while the original data remains
intact, it's hidden from view for agents without permission. This capability allows
customers to maintain data integrity while safeguarding user privacy.</p>
<p class="p">While data redaction permanently removes sensitive information, data masking provides
a way to obscure it based on user permissions.</p>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/7713908123674-About-data-masking-ADPP-add-on",
"url": "https://support.zendesk.com/hc/en-us/articles/7713908123674-About-data-masking-ADPP-add-on",
"headline": "About data masking (ADPP add-on)",
"description": "You can use data masking to restrict agents' access to personally identifiable information based on their roles, helping to protect sensitive data while maintaining its integrity in the system.",
"articleSection": "Protecting your customer's data",
"datePublished": "2024-07-29T17:40:14+00:00",
"dateModified": "2026-04-09T19:28:32.131335+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/7713908123674-About-data-masking-ADPP-add-on"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>