Masking Target Engine:
6 Sensitive Columns Detected

Schema Columns to Audit (one per line)

PII & GDPR / HIPAA Classification Matrix

ColumnClassificationMask Policy
customer_idPublic / InternalNONE
first_nameConfidential / PIIREDACT_NAME
last_nameConfidential / PIIREDACT_NAME
email_addressConfidential / PIIPARTIAL_EMAIL
ssn_numberRestricted / Highly SensitiveHASH_SHA256
credit_card_panRestricted / PCI-DSSPARTIAL_CARD
client_ipInternal / GDPR Online IDMASK_IP
signup_datePublic / InternalNONE
total_order_amountPublic / InternalNONE

Generated Dynamic SQL Data Masking DDL (SNOWFLAKE)

-- Snowflake Dynamic Data Masking Policies
CREATE OR REPLACE MASKING POLICY email_mask AS (val STRING) RETURNS STRING ->
  CASE
    WHEN CURRENT_ROLE() IN ('SECURITY_ADMIN', 'COMPLIANCE_OFFICER') THEN val
    ELSE REGEXP_REPLACE(val, '(^.).*(@.*)', '\\1***\\2')
  END;

CREATE OR REPLACE MASKING POLICY ssn_hash_mask AS (val STRING) RETURNS STRING ->
  CASE
    WHEN CURRENT_ROLE() IN ('PAYROLL_ADMIN') THEN val
    ELSE SHA2(val, 256)
  END;

-- Apply Masking Policies to Table Columns
ALTER TABLE dim_customers MODIFY COLUMN first_name SET MASKING POLICY email_mask;
ALTER TABLE dim_customers MODIFY COLUMN last_name SET MASKING POLICY email_mask;
ALTER TABLE dim_customers MODIFY COLUMN email_address SET MASKING POLICY email_mask;
ALTER TABLE dim_customers MODIFY COLUMN ssn_number SET MASKING POLICY ssn_hash_mask;
ALTER TABLE dim_customers MODIFY COLUMN credit_card_pan SET MASKING POLICY email_mask;
ALTER TABLE dim_customers MODIFY COLUMN client_ip SET MASKING POLICY email_mask;