---
schema_version: "1"
id: fb755f6c952d8bab66ed0ebcb4ca5e597a4a300cd524edbc3b7312b92b6f3a7c
title: Dynamic Data Masking Best Practices
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_dynamic_masking_best_practices.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_dynamic_masking_best_practices.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 23ab60e6f2fb0aef58781a94f79f06ac5f3cb2a48100d74c72c3565729a2265e
description: Here are some best practices for implementing dynamic data masking in Data Cloud.
products:
  - Data 360
release: "264"
---
# Dynamic Data Masking Best Practices

Here are some best practices for implementing dynamic data masking in Data Cloud.

- Identify sensitive data: Before you apply masking, identify which data fields are considered sensitive and need protection. For example, protect PII, financial records, and medical data.
- Role-based masking: Use role-based access controls to determine who sees what data. For example, senior managers can have access to full data, while other users see redacted or partially masked fields.
- Balance usability and security: Ensure that masking protects sensitive data while still allowing users to perform their tasks effectively. Aim for a balance between data protection and usability.
- Avoid masking key fields used in joins and queries: Masking fields that are used as join keys or in query filters can result in incorrect or incomplete result sets. To maintain query accuracy, avoid applying masking to fields that are critical for data relationships or filtering. A row-level security (RLS) with joins policy on masked key values doesn't return any results. Similarly, related lists based on masked fields don't show any data.