Personal Information: Mask, Wipe and Protect Fields
Data stores often hold details that could identify someone: names, email addresses, phone numbers, postal addresses, dates of birth, account numbers. Data Wrangler lets you decide, field by field, how that information is handled, so it’s only as visible as it needs to be.
You can hide a field on screen, erase it for good, erase each record after a set time, and keep it out of exports and AI tools. Here’s what each option does and how to choose.
Understanding personal information
Section titled “Understanding personal information”Suggested: When you import a file, Data Wrangler checks each column’s name and a sample of its values for things that look like personal information. Anything that matches is suggested as personal information. It’s a prompt to review, not a decision, and it doesn’t stop the import.
Mask: Hides the value on screen. The original stays stored, and it’s still included in exports.
Wipe: Erases the stored values for good, and keeps erasing any new values written to the field.
Mask + retention: Masks the field now, then erases each record’s value once it’s older than a period you choose.
Not personal information: Clears the flag. Once you choose this, future imports won’t flag the field again.
Exclude this field from exports and AI/MCP access: Keeps the field out of exports, AI assistants connected by MCP, and other apps such as dashboards and Data Explorer. It doesn’t hide the field on screen.
What the icons mean
Section titled “What the icons mean”Fields with personal information show an icon next to their name in Variable View and in the Data View column header. Hover over it to see what it means:
| Tooltip | What it means |
|---|---|
| ”Personal information needs review” | Flagged as personal information, but not protected yet |
| ”Personal information masked - the value is hidden but still stored” | Masked. Values show as •••••••• |
| ”Personal information treated” (or a message about values being erased) | Wiped, or masked with a retention period |
| ”Excluded from exports and AI/MCP access” | Left out of exports and AI tools |
Masked values show as ••••••••, and erased values show as ”—”.
Choose how a field is handled
Section titled “Choose how a field is handled”You can open the Personal Information dialog from either tab. Where you start makes a difference:
- From Variable View, your change is staged. Nothing happens until you click SAVE, so you can review several changes together.
- From Data View, your change applies as soon as you click APPLY.
From Variable View
Section titled “From Variable View”- Select the fields - On Variable View, tick one or more variables. The same choice applies to every variable you select.
- Click Handle Personal Information - It’s in the action panel that appears. Or click a field’s icon to open the dialog for that field.
- Choose an option - See the options below, then click APPLY.
- Save - Click SAVE, check the changes in Apply Changes, then click APPLY.
If you switch to Data View before saving, you’ll be asked whether to discard your changes.
From Data View
Section titled “From Data View”- Click the field’s icon - In the column header, click the personal-information icon.
- Choose an option and click APPLY - The change takes effect straight away.
Data View only shows an icon for fields that are already flagged. To flag a field Data Wrangler didn’t suggest, use Handle Personal Information on Variable View.
The options
Section titled “The options”| Option | What it does |
|---|---|
| Mask | ”Hide the value in the viewer only — original stays stored, field stays flagged.” |
| Tokenise | Not available yet: “Reserved for a future release.” |
| Wipe | ”Erase stored values, and keep erasing anything written back. Irreversible.” |
| Mask + retention | ”Mask now, then auto-wipe each record once it is older than your retention period.” |
| Not personal information | ”The field is not flagged and no personal-information treatment is applied.” |
For Mask, Wipe and Mask + retention, you can also tick Exclude this field from exports and AI/MCP access.
Masked fields show •••••••• on Data View. To keep values protected, masked fields can’t be searched, sorted, filtered or edited there. You can reveal them temporarily when you need to.
- Choose Wipe - You’ll see a warning that the wipe is irreversible.
- Type WIPE - Type WIPE in capitals in the Confirmation box.
- Click APPLY - From Variable View, remember to click SAVE afterwards.
The values are erased in the background. You can follow progress under Requests, where the request shows as Wipe Variable. After that, a daily check erases any new values written to the field.
Mask + retention
Section titled “Mask + retention”- Choose Mask + retention.
- Set the retention period - Enter a whole number in Keep for, and choose a Unit: Days, Weeks, Months (the default) or Years.
- Click APPLY - The dialog explains what will be erased and when.
A daily check erases the value in every record that’s older than your period. Records that are already older are erased at the next check. A record’s age is counted from when this data store received it.
Not personal information
Section titled “Not personal information”Choose this when a field was flagged but doesn’t hold personal information. Data Wrangler won’t flag it again on future imports. You can change your mind later from Variable View.
Notifications before and after erasure
Section titled “Notifications before and after erasure”If you’re subscribed to the data store, Data Wrangler lets you know before personal information is erased, and again once it’s gone. For a survey data store, the survey’s subscribers get these.
| When | Can it be switched off? | |
|---|---|---|
| 30 days before Mask + retention erases values | ”Reminder: personal information will be erased within 30 days” | Off by default. Turn it on for the data store. |
| 7 days before | ”Reminder: personal information will be erased within 7 days” | No, it’s always sent |
| The day before | ”Final notice: personal information will be erased tomorrow” | Off by default. Turn it on for the data store. |
| After a Wipe, a Mask + retention check or a data-scrubbing rule erases values | ”Personal information erased in …”, with how many values were erased and from which field | On by default. It can be turned off for the data store. |
The reminders say how many records will be affected. The “erased” email is only sent when values were actually erased, so a daily check that finds nothing stays quiet.
To choose which of these are sent, or who’s subscribed, the data store’s owner or an editor can use Data store settings.
Primary keys
Section titled “Primary keys”A primary key can be masked or excluded, but it can’t be wiped or given a retention period. You’ll see: “Wipe and Mask + retention are unavailable while a selected variable is an active primary key.” Likewise, a field using Wipe or Mask + retention can’t become the primary key.
Reveal a masked value
Section titled “Reveal a masked value”Sometimes you need to see a masked value, for example to check a record before you contact someone. On Data View:
- To reveal one value, click the eye icon in the cell: Temporarily reveal this cell.
- To reveal the whole column on the current page, click the eye icon in the column header: Temporarily reveal this page.
Click the icon again (Mask this cell or Mask this page) to hide the values. They’re also hidden again as soon as you sort, filter, change page, switch tabs or click Refresh Data.
Every reveal is recorded. Wiped values can’t be revealed, because there’s nothing left to show.
Retry a failed wipe
Section titled “Retry a failed wipe”If a wipe fails, you can’t change that field’s settings until it’s sorted.
- Open Requests - On Data View, click Requests to open Case Requests.
- Find the failed wipe - Look for a Wipe Variable request with the status Fail.
- Click Retry failed request - A new request starts. The old one is listed as its Previous Request.
Frequently Asked Questions
Section titled “Frequently Asked Questions”What’s the difference between Mask and Wipe?
Mask hides values on screen but keeps them, so you can reveal them and they still appear in exports. Wipe erases them for good. Mask + retention sits in between: hidden now, erased later.
Does excluding a field also hide it on screen?
No. Exclude this field from exports and AI/MCP access controls where the data can go. Choose Mask as well if you want it hidden on screen.
A field with personal information wasn’t flagged. What do I do?
Detection is only a first pass. On Variable View, select the field, click Handle Personal Information and choose how to handle it.
Why can’t I choose Wipe or Mask + retention?
One of the selected variables is the primary key. Change the primary key first, or use Mask for that field.
Why can’t I change a field’s settings?
Its wipe hasn’t finished, or has failed. Wait for it to finish, or retry the failed request. New variables that aren’t saved yet, and multi-response variables, can’t be changed either.
When exactly does Mask + retention erase a record?
At the first daily check after the record becomes older than your retention period, counted from when the data store received it.
Can I handle personal information on a published or survey data store?
Yes. It’s available on published data stores and on survey data stores.
Why can’t I search or sort a masked column?
Searching, sorting and filtering could give away hidden values, so they’re turned off for masked and wiped columns.
Common Issues and Solutions
Section titled “Common Issues and Solutions””Failed to update personal information settings.”
Section titled “”Failed to update personal information settings.””Your change couldn’t be saved. On Variable View, this message can hide a more specific reason, and your change stays staged.
- Reload and retry - Click Refresh Data, then make the change again. Someone else may have changed the field’s settings in the meantime.
- Check the field - Make sure it isn’t the primary key (for Wipe or Mask + retention) and doesn’t have an unfinished wipe.
- Contact support - If it keeps failing, contact support through Help in the header bar. Include the data store’s name and GUID (copy it from Settings).
”’…’ has an unfinished Wipe request. Wait for it to finish or retry the failed request before editing its policy.”
Section titled “”’…’ has an unfinished Wipe request. Wait for it to finish or retry the failed request before editing its policy.””The field is still being wiped, or its wipe failed.
- Check Requests - Open Requests and find the Wipe Variable request.
- Wait or retry - If it’s still running, wait for it to finish. If it failed, click Retry failed request.
”Choose an available treatment and complete any required confirmation or retention period.”
Section titled “”Choose an available treatment and complete any required confirmation or retention period.””The dialog isn’t finished yet.
- Complete the choice - For Wipe, type WIPE exactly. For Mask + retention, enter a whole number in Keep for.
”Variables using Wipe or Mask + retention cannot be assigned as primary keys: …”
Section titled “”Variables using Wipe or Mask + retention cannot be assigned as primary keys: …””You tried to make a protected field the primary key.
- Choose another key - Pick a field that isn’t wiped or under retention. See Keys, codeframes & multi-response.
”Failed to reveal the selected value.” or “Failed to reveal this page.”
Section titled “”Failed to reveal the selected value.” or “Failed to reveal this page.””The values couldn’t be revealed.
- Refresh and retry - Click Refresh Data and try again.
- Check your access - Only the Owner and users with Can Edit access can reveal values.