DataTerminology.comNEW
Also known as: Data Tokenization
Security technique replacing sensitive data with surrogate tokens stored separately, minimizing exposure and compliance scope.
DESCRIPTION
Tokenization substitutes sensitive values (e.g., PAN, PII) with non-sensitive tokens, while the original data resides in a secure token vault. It reduces breach impact and regulatory scope by limiting where sensitive data is stored and processed. Unlike encryption, tokens have no mathematical relationship to the original value and require controlled detokenization.
ALTERNATIVE DEFINITIONS
PCI Security Standards Council
Tokenization is the process of replacing the PAN with a surrogate value called a token.
Payment-focused definition centered on PAN replacement.
IBM
Tokenization substitutes sensitive data with a non-sensitive equivalent, called a token, that has no exploitable meaning or value.
Emphasizes token’s lack of exploitable meaning.
Microsoft Learn
Tokenization replaces sensitive data with tokens stored in a secure vault, reducing the exposure of the original values.
Highlights secure vault storage and exposure reduction.
RELATED TERMS
Hashing Pseudonymization Data Masking Payment Card Industry Data Security Standard Hardware Security Module Key Management Vault Data Privacy
COMPETING TERMS
Data Encryption Format-Preserving Encryption
RELATIONS
- Broader: Security
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Data Management
TARGET AUDIENCE
Chief Information Security Officer Data Privacy Officer Security Architect Cybersecurity Engineer Data Engineer
EXTERNAL SOURCES
- Wikipedia - Tokenization (data security)
- PCI SSC - Industry tokenization guidelines
- Microsoft - Architecture pattern for tokenization
- ENISA - EU guidance on pseudonymisation techniques
TOP QUESTIONS
What is tokenization in data security?
It replaces sensitive data with surrogate tokens stored in a secure vault, reducing exposure and compliance scope.
Category: Definition
How does tokenization differ from encryption?
Tokens have no mathematical relationship to the original, while encryption is reversible with keys. Tokenization requires detokenization via the vault.
Category: Comparison
What are typical use cases for tokenization?
Payment card data (PAN), PII protection, and minimizing regulated data footprint in applications and analytics.
Category: Usage
What risks are associated with tokenization?
Vault compromise, inadequate access controls, and poor auditing can re-expose sensitive data.
Category: Risks
How does tokenization help with PCI DSS compliance?
It reduces the scope by removing PAN from systems, confining sensitive data to the token vault.
Category: Benefits
What are common mistakes implementing tokenization?
Storing tokens alongside the original data, weak vault protections, and insufficient key or access management.
Category: Mistakes
Can tokens preserve format for legacy systems?
Yes, format-preserving tokens support compatibility while avoiding real values. Validate usability and collision resistance.
Category: Capabilities
How do I choose between tokenization and encryption?
Use tokenization to minimize data footprint and control detokenization; use encryption for transport and at-rest protection broadly.
Category: Recommendation
What governance is needed for tokenization?
Strong IAM, auditing, vault segmentation, lifecycle policies, and incident response for detokenization access.
Category: Requirements