Tokenisation
In data security, tokenisation replaces a sensitive value with a non-sensitive token that maps back to the original only inside a protected vault. It is the concrete answer to a PCI DSS scoping question, because the systems that hold only tokens fall outside the sensitive boundary. It is one technique of pseudonymisation, not the same thing.
How it works
Tokenisation substitutes a sensitive value (a card number, a national identifier) with a token that carries no exploitable meaning and cannot be reversed by anyone who holds only the token. The mapping between token and original lives in a protected vault, and only the small number of systems authorised to reach that vault can recover the real value. Everywhere else, applications, databases, logs and analytics work with the token, so the sensitive data exists in one guarded place instead of being scattered across the estate. Unlike encryption, where the ciphertext is a transform of the value and anyone with the key recovers it, a token has no mathematical relationship to the original that could be attacked.
What goes wrong
Two confusions cause trouble. The first is scope creep: a token vault only reduces exposure if the surrounding systems genuinely hold tokens and not the originals, and we regularly find the real values still present in a log, a backup, or an integration that never adopted the token. The exposure moves with the value, so a stray copy of the sensitive data undoes the benefit. The second is legal: tokenisation is one technique of pseudonymisation, a concept the GDPR defines, and treating the two as equal on a website that sells compliance is a risk, not a shortcut. Pseudonymised data is still personal data; tokenisation reduces exposure but does not remove the obligations.
Where this shows up in an audit
We assess tokenisation by whether the sensitive value is genuinely confined to the vault: which systems hold tokens versus originals, whether logs, backups and integrations leaked the real data, and how access to the vault is controlled. For payment data this directly informs PCI DSS scope, since systems holding only tokens can fall outside the sensitive boundary. We keep the distinction from encryption and the legal term precise in the report, and tie it to data classification. This is part of how we review data minimisation and scope.