Hashing vs Masking Bank Logs: GDPR Rules

When handling bank logs under the GDPR, the regulation does not mandate a specific technique, but it requires that personal data be processed securely and that the risk of re-identification is minimized. Hashing and masking are both recognized as pseudonymization and encryption techniques under Article 32, but they serve different purposes: hashing is for verifying data integrity and enabling secure lookups, while masking is for hiding data from unauthorized view. The GDPR’s actual requirement is that you choose a method appropriate to the risk, and for bank logs, that typically means using both: hashing for internal matching and masking for display and analysis.

Formula

The calculator above estimates a relative risk score for a bank log dataset based on two factors: hash length and the number of unmasked characters. The formula is:

Risk Score = (Hash Length / 256) × (Masked Characters / 4) × 10

• Hash Length (h) – the number of bits in the hash output (e.g., SHA-256 = 256 bits).
• Masked Characters (m) – how many characters of a sensitive field (like an account number) remain visible after masking.
• Risk Score – a unitless number where lower is better. A score of 10 equals the baseline (256-bit hash, 4 visible characters). Doubling the visible characters or halving the hash length doubles the score.

This is a heuristic, not a legal metric, but it illustrates the trade-off: longer hashes and shorter visible substrings reduce re-identification risk.

Worked Example

Using the default values: 1,000 log entries, a 256-bit hash, and 4 masked characters kept.

1. Hash length factor: 256 / 256 = 1
2. Masked character factor: 4 / 4 = 1
3. Risk score: 1 × 1 × 10 = 10

The calculator returns a risk score of 10. If you reduced the visible characters to 2, the score would drop to 5. If you increased to 8, it would rise to 20.

What the GDPR Actually Says About Bank Logs

The GDPR does not use the terms “hashing� or “masking.� Instead, Article 32(1)(a) requires “appropriate technical and organisational measures� to ensure a level of security appropriate to the risk, including “the pseudonymisation and encryption of personal data.� Recital 28 clarifies that pseudonymisation means processing personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, kept separately. Hashing and masking are both forms of pseudonymisation when done correctly, but they have different threat models.

For bank logs – which contain account numbers, sort codes, transaction amounts, and sometimes names – the primary risks are data breaches, insider misuse, and accidental exposure. Hashing alone does not protect against brute-force attacks if the input space is small (e.g., account numbers are often 8–14 digits, which is trivially brute-forceable). Masking alone does not protect the underlying data if the masked data is still stored somewhere. The GDPR’s risk-based approach means you must assess both the likelihood and severity of harm, and implement measures proportional to that risk. For bank logs, that typically means encryption at rest, hashing with a salt for any field used as a lookup key, and masking for any field displayed in a UI or log.

How Hashing Works for Bank Logs

Hashing is a one-way function: you take an input (like an account number) and produce a fixed-length string of characters (the hash). The same input always produces the same hash, but you cannot reverse the hash to get the original input. Common algorithms are SHA-256 and SHA-3. However, because bank account numbers have limited entropy, an attacker can pre-compute hashes of all possible account numbers and compare them to your hashes – this is a rainbow table attack. To prevent this, you must add a salt: a random value appended to the input before hashing. The salt is stored alongside the hash, but it makes pre-computed tables useless.

For bank logs, hashing is useful when you need to correlate records across systems without exposing the actual account number. For example, you might hash the account number and use that hash as a join key. But you must also store the salt securely, and you must consider that even salted hashes can be brute-forced if the input space is small. A 14-digit account number has 10^14 possibilities – that’s a lot, but not impossible for a determined attacker with GPU clusters. So hashing alone is not sufficient for bank logs; it must be combined with access controls and encryption.

How Masking Works for Bank Logs

Masking replaces part of a value with a placeholder, such as asterisks or ‘X’. For example, an account number 12345678 becomes “****5678â€�. Masking is reversible if you keep the original data elsewhere, or irreversible if you only store the masked version. The GDPR does not require irreversible masking, but it does require that the masked data be used for its purpose and that the original data be protected.

For bank logs, masking is typically applied to fields that appear in UI screens, error messages, or exported reports. The goal is to prevent someone who sees the log from reading the full account number. However, masking has a weakness: if the masked portion is predictable (e.g., you always keep the last 4 digits), an attacker can still guess the full number if they know the bank and the account holder. Also, if the same account number appears in multiple logs with different mask lengths, an attacker can infer information. The GDPR’s principle of data minimisation (Article 5(1)(c)) suggests you should only keep the masked version if you don’t need the full number for the processing purpose.

Choosing Between Hashing and Masking

The choice depends on what you need to do with the bank log data. Use hashing when you need to:

• Match records across datasets without revealing the original value.
• Verify data integrity (e.g., detect tampering).
• Store a lookup key that can be used for joins.

Use masking when you need to:

• Display data to users or analysts who do not need full values.
• Export data to a test environment.
• Comply with screen-scraping protections.

In practice, you often need both: hash the account number for internal joins, and mask it for any output. The GDPR does not require one over the other, but it does require that you document your decision and justify it based on the risk assessment. A common mistake is to assume that hashing is “anonymisation� – it is not, because the hash can be reversed with enough effort. The GDPR’s definition of anonymisation (Recital 26) is that the data can no longer be used to identify a natural person, which is rarely achievable with hashing alone.

Common Problems and Misconceptions

One common misconception is that hashing is the same as encryption. Encryption is reversible with a key; hashing is not. If you need to retrieve the original account number, you must use encryption, not hashing. Another misconception is that masking is sufficient for GDPR compliance if you remove names. But bank logs often contain other identifiers, like transaction amounts and timestamps, which can be combined to re-identify a person. The GDPR requires you to consider the “means reasonably likely to be used� to re-identify – that includes cross-referencing with other data.

A frequent problem is that hashing is applied without a salt, making it vulnerable to rainbow table attacks. Another is that masking is applied inconsistently – for example, some logs show the full account number, others show only the last 4 digits. An attacker who sees both can infer the full number. Also, many people forget that hashes and masked values are still personal data under the GDPR, because they can be linked to an individual. That means you still need a lawful basis for processing, and you must apply all other GDPR principles, such as purpose limitation and storage limitation.

Finally, there is the issue of key management. If you use encryption or salted hashing, you must store the keys or salts securely. If an attacker gets both the data and the key, the protection is useless. The GDPR does not specify how to manage keys, but it requires appropriate measures – that usually means using a hardware security module or a dedicated key management service.

Costs and Practical Considerations

Implementing hashing and masking has costs: development time, performance overhead, and operational complexity. Hashing thousands of log entries per second is cheap, but adding a salt and storing it securely adds storage and management overhead. Masking is usually a simple transformation, but you need to decide on the mask format and ensure it is applied consistently across all systems. There is also the cost of training staff and auditing the process.

For a small company, a simple approach might be to use a well-known library (e.g., OpenSSL) for hashing with a per-record salt, and a simple masking function that keeps the last 4 digits. For a large enterprise, you might invest in a data masking tool that automatically discovers sensitive fields and applies consistent rules. The GDPR does not require a specific budget, but it does require that you demonstrate you have considered the risk and taken proportionate measures. A low-cost solution that is well-documented is often better than an expensive one that is poorly implemented.

Alternatives and Complementary Measures

Besides hashing and masking, other techniques can protect bank logs:

• Encryption – reversible, use for storing the full data at rest or in transit.
• Tokenization – replace a sensitive value with a random token that maps to the original value in a secure vault. This is stronger than hashing because the token has no mathematical relationship to the original.
• Redaction – completely removing sensitive fields from logs. This is the simplest and often the most GDPR-compliant, because you simply don’t collect what you don’t need.
• Access controls – limit who can see the raw logs. This is not a substitute for hashing/masking, but it reduces the risk of insider misuse.
• Audit logging – log who accessed the data and when, to detect and deter misuse.

The GDPR encourages a layered approach: use encryption for storage, hashing for joins, masking for display, and access controls for everything. No single technique is sufficient on its own.

Frequently Asked Questions

Is hashing bank account numbers enough to be GDPR compliant?

No. Hashing is a security measure, but it does not make the data anonymous. If an attacker can brute-force the hash (which is easy for account numbers), they can recover the original value. You must add a salt, use a strong algorithm, and combine hashing with other measures like encryption and access controls. The GDPR requires a risk-based approach, not a single technique.

Can I mask account numbers and still use them for analysis?

Yes, if you only need the last 4 digits or a range, masking is fine. But if you need to perform joins or lookups, masking won’t work because the masked values are not unique. In that case, use hashing for the join key and masking for display. Always document why you need the full number – if you don’t, you should not store it.

What is the difference between pseudonymisation and anonymisation under the GDPR?

Pseudonymisation means replacing identifiers with a code (like a hash or a mask) but keeping the ability to re-identify with additional information. Anonymisation means irreversibly removing all identifiers so that the data can no longer be linked to a person. Hashing and masking are forms of pseudonymisation, not anonymisation, unless you also delete the mapping data and make re-identification impossible.

Does the GDPR require me to hash or mask all bank logs?

No. The GDPR requires you to implement appropriate measures based on the risk. If you have a small amount of bank logs and strong access controls, you might decide that encryption alone is sufficient. But if you have large volumes and many users, hashing and masking are likely to be considered appropriate. The key is to document your risk assessment and the measures you took.

What happens if I only mask the account number but keep the full number in the same log?

That defeats the purpose of masking. If the full number is in the same record, anyone who sees the log can read it. Masking is only useful if the full value is stored elsewhere (e.g., in an encrypted database) and the log only contains the masked version. Otherwise, you are just adding a cosmetic layer that provides no real protection.

Can I use the same hash for the same account number across different systems?

You can, but that creates a link between systems, which might be a privacy risk. If an attacker gets the hash from one system, they can match it to another system. To reduce this risk, use a different salt per system, or use a keyed hash (HMAC) with a system-specific key. That way, the same account number produces different hashes in different systems.

Related

• Sweet Herring Dreamlight Valley: Recipe & How to Cook
• GTA 6 Music System: Stream Playlists Explained
• Dollar Cost Averaging: How It Works

in t | Number of log entries | - | 1000 | 1 | 1000000
in h | Hash length (bits) | - | 256 | 128 | 512
in m | Masked characters kept | - | 4 | 0 | 16
out risk | Relative risk score (lower is better) | - | (h / 256) * (m / 4) * 10 | 2