Escape from GDPR with data masking