扒哥吃瓜

罢丑颈蝉听DWP Obfuscation Security Policy听is part of a suite of policies designed to promote consistency across the Department for Work and Pensions (DWP) and supplier base with regards to the implementation and management of security controls. For the purposes of this听policy, the term DWP and Department are used interchangeably.鈥�听

Security policies considered听appropriate for听public viewing are published on 扒哥吃瓜听

Security policies cross-refer to each other where needed, so can be confidently used together. They听contain听both mandatory and advisory elements, described in consistent language (see table below).

Term	Intention
must	denotes a requirement: a mandatory element
should	denotes a recommendation: an advisory element
may	denotes approval
might	denotes a possibility
can	denotes both capability and possibility
is/are	denotes a description

Overview听

1. The DWP Data Obfuscation Security Policy outlines the enterprise level requirements for how data must be obfuscated or transformed to protect sensitive information across the Department.

Purpose听

2. This policy is to听mandate the high-level requirements for the type and degree of data transformation听required听based on data sensitivity, processing environment, and intended use, ensuring residual data risk听remains听within the Department鈥檚 acceptable tolerance.听This policy听supersedes the 2019 DWP Data and Analytics Data Obfuscation Policy.听

Scope听

1. This policy applies to:听

(a) All听DWP personnel (including employees, contractors, and temporary staff)听involved in the design, development, processing or management of DWP data transformation and obfuscation processes.听

(b) All contracted suppliers whose systems or services store, handle, or process DWP information, or are involved in the provision and lifecycle management of hardware for the DWP; to ensure the appropriate levels of assurance for the confidentiality, integrity and availability of the DWP鈥檚 assets.

(c) All DWP data assets听including those managed by suppliers, across all environments (on-premise, hybrid, and cloud) and in all states (at-rest, in-motion, in-use).听

(d) Personnel assigned to roles with privileged access to sensitive data assets, including those managed by suppliers or hosted offshore,听must听hold the听appropriate level听of security clearance as defined by the DWP Vetting Policy for that specific assigned role.

2. This policy does not replace any legal or regulatory requirements.

Definitions听

Acceptable Tolerance听

The level of residual re-identification risk a Data Owner is willing to accept, as documented in a Data Protection Impact Assessment (DPIA) and approved by the Information Asset Owner (IAO).听

Artificial Intelligence

A computer programme which 鈥渓earns鈥� from data and may perform tasks usually carried out by humans.听

Anonymisation听

Anonymisation is a process that听renders听individuals not identifiable by any means听reasonably likely听to be used, thereby听residing听outside the scope of data protection law.听

Data Minimisation听

The听principle of collecting,听processing听and storing the听minimum听amount of personal data听required听to fulfil听a defined purpose.

Data Masking听

Replacing sensitive data with fictional or scrambled values while preserving the data鈥檚 format. Common examples include replacing names with pseudonyms or masking credit card numbers.听

Encryption听/听Tokenisation

The process of鈥痗onverting鈥痠nformation or data into a code, especially to prevent unauthorised access.听

Infrastructure as a Service

A cloud model delivering virtualized computing resources 鈥� such as servers, storage, and networking 鈥� over the internet.听

Irreversible Masking

A one-way substitution of听data which can no longer be听reinstated to its original form.听

Mandatory Transformation Tier

The听structured, mandatory processes of听modifying听raw data to meet legal,听security听or privacy requirements.听

Motivated Intruder Test听

A听re-identification听risk assessment method听identified听within the听Information Commissioner鈥檚 Office (ICO) Anonymisation Code of Practice听to听determine听if a person without prior knowledge could听identify听an individual from an anonymised听data asset, considering all means听reasonably likely听to be used.听

Obfuscation

A collective term for technical measures (for example听masking, pseudonymisation, aggregation, anonymisation, tokenisation, encryption) that reduce the risk of听identifying听individuals from data. Obfuscation does not in itself remove data from the scope of data protection law unless the outcome meets the standard for anonymisation.听

Platform as a Service

A cloud model where the provider manages the underlying infrastructure, allowing customers to build, deploy, and manage applications without听maintaining听servers or operating systems.听

Production Derived听Data听Assets

Specialised data assets generated by applying transformations, aggregations, or calculations to raw, primary, or operational 鈥渟ource-of-truth鈥� data within a production environment.听

Pseudonymisation

The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is subject to technical and organisational measures to keep it separate.

Record of Processing Activities (ROPA)

A formal record which documents how an organisation processes听personal听data,听describing听the purpose of processing, categories of personal data and data subjects, lawful听basis听for processing,听data听sharing arrangements, retention听period听and the technical and听organisational听security measures applied.听听

Software as a Service

A cloud service model where the provider runs an application shared between customers, who then configure and consume it, opposed to managing the underlying infrastructure.听

Suppliers

Any external organisation or individual providing services, systems, or hardware to the Department under a formal agreement, including contractors and service providers.

User Acceptance Testing

A critical, final phase of assurance where end-users听validate听that a system or service meets their needs, functions as expected in real-world scenarios and听operates听within defined risk appetites prior to going live.听

Policy Statements听

1. The principle of Data Minimisation听must听be听applied to all听data assets prior to transformation or usage.听听

2. All requests for access or migration of Production Derived Data Assets (PDDs) must specify the Mandatory Transformation Tier required to satisfy this policy, as mandated by the relevant Data Owner.

3. The听selection听of the Mandatory Transformation Tier听must听be documented by the Data Owner,听identifying听which of the four protection levels (Encryption, Pseudonymisation, Irreversible Masking, or Anonymisation) is听required听for the specific use case.听

4. Initiatives which involve transformation activities relating to personal data听must听follow the Data Protection Impact Assessment (DPIA) process and where transformation activities affect the identifiability听comply with听the Motivated Intruder Test. The required execution and evaluation criteria for this test will be proportionate to the identified risk and defined in DWP obfuscation procedures.听

5. Data protection for operational systems, including Critical National Infrastructure (CNI) systems hosted in the Cloud听must听be primarily secured via strong access controls and encryption, in line with the听DWP听Cryptographic Key Management Policy听and听SS-007: Use of Cryptography.听

6. For non-production cloud environments (Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS)), encryption at rest (SS-007: Use of Cryptography) is a mandatory baseline but听must not听be used as a substitute for irreversible masking. Non-production environments are听strictly prohibited听from听containing听unmasked sensitive production data.听

7. Where听a听documented business requirement for individual identification exists (for example听for social research sampling or fraud targeting),听data assets may be exempt from the Irreversible Masking mandate if hosted within a Protected Analytical Environment. These environments must implement production-equivalent security controls, including granular Role-Based Access Control听(RBAC) and comprehensive auditing.听

8. Where a business requirement exists to perform individual identification or selection within a secondary environment (for example听for cohort targeting), the data听must听be hosted in a Protected Analytical Environment. These environments are not subject to obfuscation mandates but must implement production-equivalent controls, including strict RBAC, full auditing, and adherence to the record indistinguishability听manual.听

9. Policy implementation听must听ensure that data transformation听maintains听sufficient utility for analytical modelling and social research (for example听preserving event ordering and precision for business-critical variables), provided re-identification risk听remains听within tolerance.

10. Any display-level (dynamic)听masking听used within operational user interfaces (for example听to confirm bank details)听must听be implemented at the application tier and must not alter the underlying data at rest.听

11. Irreversible听Masking听must听be performed听on all听highly sensitive听personal听data听prior to听copying, migration, or听provisioning听into any non-production, development, or听User Acceptance Test (UAT)听environment.听

12. Protection听must听be applied to听Artificial Intelligence听(AI)听and听machine听learning training pipelines to prevent accidental data exposure via membership inference or model outputs.听

13. Non-production听Database Management Systems (DBMS)听must听implement听technical ingress controls听(for example听pre-restore听triggers) to听prohibit the restoration or importing听of unmasked production data, in compliance with听SS-005:听Database Management System.听

14. Data used for statistical publication or shared with external research bodies must achieve a verified level of anonymisation (for example K-Anonymity, Differential privacy) to prevent re-identification and reconstitution attacks. The Department must ensure that no form of differential data masking or obfuscation applied to data in operational services compromises the requirement for sensitive records to remain indistinguishable.

15. Where听pseudonymisation is听required听to听maintain听data linkage in analytical platforms, the method听must听adhere to the cryptographic hashing, salting (鈥淧epper鈥�), secure key management requirements听defined in supporting DWP technical products, standards, and patterns.听Additional听information听must听be logically and physically separated with access听strictly limited.听

16. Where privilege access is听required听to administer, transform, migrate,听restore听or manage sensitive data assets this must听comply with听DWP Privileged Users Security Policy听and听SS-001-2: Privileged User Access.

Accountabilities and Responsibilities听

(a) The DWP Chief Security Officer is the accountable owner of the DWP听Obfuscation Security Policy听and听is responsible for听its maintenance and review, through the DWP Deputy Director for Security Policy and听Central Services.听

(b) The Data Owner is accountable for the anonymised / pseudonymised outcome for each data asset, ensuring the lawful basis, purpose limitation and data minimisation principles are applied and documented, and accepts any residual re鈥慽dentification risk within the DPIA /听Record of Processing Activities (ROPA)听before authorising onward use or disclosure.听

(c) The Information Asset Owner听(or equivalent role as defined by the Chief听Data听 Office)听is accountable for the information asset鈥檚 management and protection, maintaining the听Information Asset听Inventory听(also referred to in security standards as the Information Asset Register or IAR), setting and monitoring access, sharing, retention and disposal controls, and providing assurance that controls are appropriate and proportionate.

(d) Product / System Owner听is responsible for听implementing and enforcing the approved outcomes by encryption and other controls for obfuscated data.听

(e) Suppliers that cannot听comply with听the security policy must request a security policy exception. All exceptions, security gaps, or use of non-standard access (such as generic accounts) must be risk-assessed and ratified by the听appropriate formal听governance board (for example, the Digital Design Authority or Policy and Standards Review Group (PSRG)) prior to Senior Responsible Owner (SRO) acceptance.听

Compliance

(a) All DWP employees, whether permanent or temporary (including DWP鈥檚 contractors) have security responsibilities and must be aware of, and听comply with, DWP鈥檚 security policies and standards.听听

(b) Many of DWP鈥檚 employees and contractors handle sensitive information daily听and so need to be enacting听minimum听baseline behaviours听appropriate to听the sensitivity of the information.听Most security incidents and breaches relate to information security.

(c) Failure to鈥痳eport a security incident, potential or otherwise, could result in disciplinary action and, in the most severe circumstances, result in dismissal. A security incident is the attempted or actual unauthorised access, use, disclosure, modification,听loss听or destruction of a DWP asset (or a supplier asset that provides a service to the Authority) in violation of security policy. The circumstances may include actions that were actual, suspected, accidental, deliberate, or attempted.鈥疭ecurity incidents must be reported as soon as possible. Suppliers must follow the鈥�DWP Security Incident Management Standard (SS-014).

(d) DWP鈥檚 Security and Data Protection Team will regularly assess for compliance with this policy and may need to inspect physical locations, technology systems,听design听and processes and speak to people to听facilitate听this. All DWP employees, agents, contractors, consultants, business听partners听and service providers will听be required听to听facilitate, support, and when necessary,听participate听in any such inspection. DWP Collaboration and Communication Services will use software filters to block access to some online websites and services.

(e) Any exemption to this policy听must听be formally risk-assessed and approved by the听appropriate governance听board (for example the Digital Design Authority (DDA) or PSRG), rather than solely by the project Senior Responsible Owner (SRO). If an individual is aware of an activity that falls into this category, they should notify the Security Policy and Standards Team听immediately.