How tokenization works
When sensitive data enters a system, a tokenization service generates a token, often in the same format as the original, and stores the mapping in a hardened vault. Applications then store and pass only the token.
When the real value is genuinely needed, such as to process a payment, an authorized service requests detokenization from the vault. Unlike encryption, a token cannot be reversed with a key because no algorithm links it to the original. Tokens can be format-preserving, so existing applications and databases continue to work, or they can be single-use values for one transaction, depending on the risk and the system design.
Why it matters for Canadian organizations
Systems that hold only tokens are less attractive to attackers and may fall outside parts of compliance scope. For payment data, this can substantially reduce the systems subject to PCI DSS requirements.
Tokenization can also support privacy goals under PIPEDA and Law 25 by limiting where identifiable personal information is stored. It does not remove legal obligations, since the vault and the original data still need strong protection. Because the vault becomes a high-value target, it should be isolated, heavily monitored and subject to regular testing, and keys protecting it should be managed carefully.
How to implement it
Identify where sensitive data enters, moves and rests, then decide which fields can be replaced. Use a reputable tokenization service or vault with strict access control, logging and high availability.
Restrict who and what can detokenize, monitor those requests, and secure the vault with strong authentication and encryption. Test applications and analytics to confirm they work with tokens, and document the design for auditors. Consider whether encryption, masking or tokenization best fits each use case, as they solve related but different problems, and many programs use more than one.
Frequently asked questions
Is tokenization the same as encryption?
No. Encryption transforms data with a key and can be reversed by anyone holding that key. Tokenization substitutes a random value and relies on a secured lookup vault, so the token itself cannot be mathematically reversed. Both methods have a place in a security program.
Does tokenization make you PCI DSS compliant?
Not by itself. It can reduce the number of systems that store card data and so narrow PCI DSS scope, but the token vault, the processes around it and any remaining cardholder data environment must still meet the standard.
What can be tokenized?
Payment card numbers are the classic case, but tokenization also protects health card numbers, social insurance numbers, bank accounts, email addresses and other identifiers. It suits fields that need to be referenced but rarely viewed in clear form.
Related service: Security consulting