Native Data Masking

Metabase currently has no native way to enforce field-level masking automatically when reports are delivered via email subscriptions or exported, while simultaneously allowing authorized users to view unmasked data in-app. This is a blocker for customers operating under GDPR or similar data privacy regulations.

Authorized users must be able to view data in its original, unmasked form within Metabase.
When a report is shared via email (real-time or scheduled subscription), specific fields must be automatically masked according to a global masking policy — with no per-report configuration required.
The masking policy should be configurable globally by an admin (e.g., "always mask columns tagged as PII in email output") without requiring modifications at the database or individual report level.

A global masking policy configuration in Metabase Admin settings that allows admins to define:

Which fields or column types are considered sensitive (e.g., tagged as PII)
Which delivery contexts trigger masking (e.g., email subscriptions, CSV exports)
What masking format to apply (e.g., partial mask, hash, redaction)

This would operate independently of how individual questions or dashboards are built, ensuring consistent enforcement across all outbound report delivery.

The issue names no files, tests, or entry points. Start by locating Metabase Admin settings and the email-subscription and CSV-export flows; done means global masking rules apply in those outbound contexts while authorized in-app users still see unmasked data.

Written by the indexing model from the issue text.