This thesis investigates the adoption and implementation of data masking solutions within the financial services sector, particularly in response to the European Union’s landmark 2016 regulation on data protection. Article 25 of this regulation mandates that organizations employ adequate technical and organizational measures to integrate data protection principles by design and by default. Data masking emerges as a critical strategy for achieving compliance, transforming the way businesses handle user data and setting a benchmark for data privacy practices worldwide. The study is anchored in a practical experience gained through an internship at PwC Italy, aiming to implement a data masking solution that meets the specific GDPR compliance needs of a client.