Snowflake Dynamic Data Masking

Snowflake Dynamic Data Masking is a column-level security feature that hides sensitive values at query time based on who is asking. The data stays unchanged in storage, but a masking policy decides whether a user sees the full value, a partially masked value, a hashed value or a null, depending on their role or other context.

Masking policies are written as SQL expressions and attached to columns once, after which they apply consistently to every query, view, BI dashboard and data share that reads the column. Conditional masking can look at other columns in the same row, and tag-based masking lets administrators attach a policy to a tag so every column tagged as, for example, email or national ID is protected automatically. The feature requires Snowflake Enterprise Edition or higher and works alongside role-based access control and row access policies.

Teams use it to let analysts and data scientists work with production tables while keeping personal, financial or health data hidden from people who do not need it, supporting GDPR, HIPAA and PCI DSS obligations without maintaining separate de-identified copies.