Entities - Review and Implement Production Data Masking for the Sandbox Environment

**Description**

Refer to the RAID ticket https://app.zenhub.com/workspaces/raid--work-space-617c3d4cef313f001d715a7c/issues/gh/bcgov-registries/raid/786 for background information

The Sandbox environment is populated with data copied from the Production environment. To ensure sensitive production data is appropriately protected, masking requirements must be defined and implemented.

Although the business registration application does not contain personal information, it contains business information that is only available in the Production environment after payment of the applicable fee. Entities team should review and determine such data elements and provide full list of tables and attributes to the SRE team.

Based on the approved specification, the SRE team will implement and validate the masking process.

The SRE team's responsibility is to build and run the masking job initially, while the Product/Entities team owns the business decision about when Sandbox data should be refreshed and, consequently, when the masking job should be run again.

**Background**

Initial data obfuscation work was completed in 2025 based on the rules documented here: [BR Prod Data Obfuscation Rules - V0 - Apr 2025](https://bcgov.sharepoint.com/:x:/r/teams/13651/_layouts/15/Doc.aspx?sourcedoc=%7B603FF516-2FEA-41F4-B21B-9C710943CE96%7D&file=BR%20Prod%20Data%20Obfuscation%20Rules.xlsx&action=default&mobileredirect=true)

A recent review confirmed that data obfuscation for corporations is currently being applied in Sandbox.

However, it cannot be confirmed that the original implementation was fully validated against all applicable data elements and requirements. In addition, changes to the data model and business processes may have occurred since the initial implementation (confirmed with Argus).

Given the onboarding of additional API clients, a comprehensive review of the data inventory, masking criteria, mappings, and masking rules is required to ensure that all in-scope data is appropriately protected and that the implementation aligns with current requirements.

**Scope**

Product Team

- Review production-derived data in Sandbox.
- Identify **ALL tables and attributes** requiring masking.
- Define the masking requirements and business rationale.
- Approve the masking specification.
- Verify masking is applied (after implemented by SRE)

SRE Team

- Update and execute a reusable masking job based on the approved specification.
- Validate that the masking has been applied successfully.
- Document how the masking job is executed so it can be rerun after future data refreshes.