A nonprofit has employed a contract developer for work involving objects that contain personal and...

When a nonprofit uses a Full Copy Sandbox, the sandbox contains an exact replica of all the production data, including sensitive donor PII (Personally Identifiable Information). Giving a contractor access to this data is a significant security and compliance risk.

The Solution: Salesforce Data Mask:

Anonymization: Salesforce Data Mask is a powerful managed package that allows an admin to "scrub" or "mask" sensitive data in a sandbox.

Methods: It can replace real names with random names (Anonymization), replace characters with "X" (Deletion), or shuffle values within a column (Pseudonymization).

Developer Experience: The contractor can still see the structure of the data and write code against it, but the actual "John Doe at Main St" becomes "Sam Smith at 999 West Rd."

Security: This ensures that even if the developer's local machine or account is compromised, no real constituent data is exposed.

Why other options are incorrect:

Encryption (Options A & C): This protects data at rest but does not help if the developer has the permissions to view the decrypted data for testing purposes.

Profiles (Option D): This is insufficient because a developer often needs access to the fields themselves to write code; Data Mask allows them to see the field while hiding the sensitive content.