Protect Personally Identifiable Information (PII) in Your Apps Using RudderStack | RudderStack

By neub9
4 Min Read


Personally Identifiable Information (PII) is the information that may be used to identify and track an individual. GDPR mandates software companies to encrypt any PII and ensure that they protect the users’ identity from any misuse. In a post-GDPR world, all organizations need to detect and mask/obfuscate/delete PII data flowing through their information systems. This article provides more information on PII and how to protect it.

Reason for PII Data Leak

One typical reason for PII data leak is human error. Developers add various user-centric attributes as part of the “traits” structure in a message, which may inadvertently include a PII event that gets forwarded to the destination. This could be almost a disaster from the data privacy perspective.

PII Detection and Masking

At RudderStack, we simplify the process of performing PII checks and incorporating corrective actions on the streaming data. Hence, we have provided template PII Detection and Masking code on GitHub. Developers/administrators can introduce this code as a user transformation in their RudderStack installation via the Config Plane. This transformation will protect human PII data leak oversights from resulting in serious non-compliances.

Benefits of Masking PII within RudderStack

You can mask/obfuscate PII within RudderStack, which eliminates the need to encrypt such data for GDPR compliance, reduces risks associated with a potential data breach, and eliminates the need to search through and delete data in the event of the withdrawal of consent.


To implement the PII detection and masking code, copy the code from GitHub into the Transformation window under Transformation Settings for a user transformation in Rudder Configuration Plane. The code leverages the fuzzysort implementation and provides a method for substituting PII fields with obfuscations for fuzzy matched keys.

PII Substitution Logic

The transform method is the entry-point for any user transformation. It takes an array of event objects as an argument and returns an array of transformed event objects. The sample code provided demonstrates how to iterate through each event and invoke the walk method, which performs the PII substitution logic.

Sample PII Detection and Masking Transformation in Action

The provided screenshots show the transformation in action, including an exact match with one of the keywords specified and a fuzzy match where the field name does not exactly match any of the keywords supplied.


The template PII Detection and Masking code is a useful tool to integrate PII detection and masking into your RudderStack installation. It is available as a part of the open-source sample transformations collection, and you can modify the walk event according to the complexity and flexibility you want in your detection and masking code.

Start Sending Data

Test out RudderStack’s event stream, ELT, and reverse-ETL pipelines by signing up for free. Use the HTTP source to send data in less than 5 minutes, or install one of RudderStack’s 12 SDKs in your website or app to get started.

Share This Article
Leave a comment

Leave a Reply

Your email address will not be published. Required fields are marked *