Masking of PII Data on HCM Pages
Purpose: To maintain the safety of employee data and to align with the expectation of least privilege the HCM pillar has been updated as of November 6, 2026, to mask access to sensitive data. The following fields are being masked either through delivered masking or by applying specialize masking through Page & Field Configurator:
- Bank Account Number
- Date of Birth
- Driver's License Number
- Citizenship Proof
- National ID (NID)/Social Security Number (SSN)
- Passport Number
- Visa/Permit Number
Use of these masking approaches prevents the viewing of highly sensitive data on those pages, unless a specific security role is granted enabling the viewing of this sensitive data.
Audience: Local Security Administrators and HR Staff participating in User Acceptance Testing.
The following navigational paths will have Oracle delivered or applied (via Page & Field Configurator) masking turned on to mask PII data for all records. Click on each page link to view where the masked field exists, how it will appear when masked, and what security roles will allow the field(s) to be unmasked:
Navigation: Main Menu>Benefits>Employee/Dependent Information>Update Dependent/Beneficiary
On the Update Dependent/Beneficiary component, on the Personal Profile tab, in the Personal Profile section, the Date of Birth field is masked to hide the birth year for each of the employee's dependents/beneficiaries.
Also on the Personal Profile tab, in the National ID section the National ID field is masked, with only the last 4 digits of each of the employee's dependents/beneficiaries. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZD Benefits Employee Data Inq
- ZC Benefits Enrollments
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Biographical>Driver's License Data
On the Driver's License Data page, in the Driver's License Information section the Driver's License Nbr field is masked, with only the last 4 digits of the number visible.
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask Drivers License security role to unmask the specific Driver's License Nbr field. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Biographical>Update Person Detail
On the Update Person Detail page, on the Biographical Details tab, in the Biographic Information section the Date of Birth field is masked.
On the Biographical Details tab, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZD HCM SOGI
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Citizenship>Citizenship, Visa and Permits
On the Citizenship/Passport tab, in the Citizenship/Passport section the Passport Number field is masked, with no digits of the employee's passport number displayed:
On the Visa/Permit Data tab, in the Visa/Permit History section the Number field is masked (except last 3 characters), with no digits of the employee's visa permit number displayed:
Not sure if your college stores Visa/Permit data in ctcLink?
If you have access to HR Core data in Query (ZD_DS_QRY_HRCORE), then you can run the query QHC_HR_JOB_VISA_EXP. If you enter your college's company code and no results return then it is highly likely that your college does not store this information in ctcLink.
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the specific passport or visa/permit field. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Modify a Person
On the Modify a Person page, on the Biographic Details tab, in the Biographic Information section, the Date of Birth field is masked to hide the birth year.
Also on the Biographic Details tab, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's SSN displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
- ZD HR Inquiry
- ZD HR Central Config VW
- ZD HCM SOGI (this role does not display the regional tab)
- ZD HR Limited Person Job Info (this role does not display the regional tab)
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
On the Regional tab, in the History section the Citizenship (Proof 1) and Citizenship (Proof 2) fields are masked. This field can contain information such as green card or other open text words that would reveal an employee's immigration status.
Not sure if your college stores Visa/Permit data in ctcLink?
If you have access to HR Core data in Query (ZD_DS_QRY_HRCORE), then you can run the query QHC_HR_JOB_VISA_EXP. If you enter your college's company code and no results return then it is highly likely that your college does not store this information in ctcLink.
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZZ HR Employee Maintenance
- ZZ SS Workforce Administrator
- ZD HR Inquiry
- ZD HR Central Config VW
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the passport, visa/permit and citizenship proof fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Personal Relationships>Dependent Identification
While this page has been included in HCM masking delivered masking set, it is unlikely that colleges will have data on this page as it is not a standard business practice to collect the passport and/or visa permit data for dependents.
On the Dependent Identification page, on the Depdnt Citizenship/Passport tab, in the Passport Details section the Passport Number field is masked, where no digits of the passport number of the dependent of the employee are displayed:
On the Depdnt Visa/Permit Data tab, in the Visa/Permit History section the Number field is masked (except last 3 characters), where no digits of the visa permit number belonging to the dependent of the employee are displayed:
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask Passport security role to unmask the specific passport and visa/permit fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu>Workforce Administration>Personal Information>Personal Relationships>Dependent Information
On the Dependent Information page, on the Person Profile tab, in the Person Profile section the Date of Birth field is masked to hide the birth year.
Also, in the National ID section, the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
The following security roles grant access to this page with the PII fields masked to hide their content:
- ZC HR Employee Maintenance
- ZD HR Central Config VW
- ZD HR Employee Maintenance VW
- ZD HR Inquiry
- ZZ HR Employee Maintenance
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask National ID_SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
Navigation: Main Menu > Benefits > Employee/Dependent Information > Employee HR and Payroll Data
On the Employee HR and Payroll Data page, in the National ID section the National ID field is masked, with only the last 4 digits of the employee's Social Security Number displayed. The National Identification Number (NID) for US citizens equates to the Social Security Number (SSN).
Also, in the Significant Dates section, the employee's Date of Birth is masked with the month and day visible, but the year masked.
The following security role grants access to this page with the PII fields masked to hide their content:
- ZD Benefits Employee Data Inq
To view the clear text data in the field without masking, the Local Security Administrator would need to apply the ZZ HC Unmask SSN or the ZZ HC Unmask DOB security role to unmask the specific fields. To unmask all masked fields in the HCM pillar the Local Security Administrator to apply the ZZ HR PII Data security role.
0 Comments
Add your comment