A financial institution is implementing a cloud-based data lake to consolidate various data sources, including transactional data, customer demographics, and market feeds. Due to regulatory compliance requirements (e.g., GDPR, CCPA), the institution must ensure that individual customer data within the data lake cannot be directly linked back to a specific person, even if the data is compromised. However, the data must still be useful for statistical analysis and trend identification. Which data protection technique is most appropriate for this scenario?

Why the other options are wrong

• B. Encryption protects data confidentiality but doesn't inherently prevent re-identification if the key is compromised and the original data structure remains.
• C. Data masking replaces sensitive data with fictitious but realistic data, often for testing or training environments, making it difficult to reverse, but often less useful for statistical analysis of real trends than pseudonymized data.
• D. Tokenization replaces sensitive data with a non-sensitive equivalent (token), often used for payment card data, but typically aims for a one-to-one mapping that can still be de-tokenized, making re-identification possible with the token vault.