From CSV to Safer JSON: A GDPR/KVKK Masking Pipeline

Narrow purpose and scope first

Masking does not create a lawful basis for collecting data. Document why the CSV is processed, which columns are necessary, and who receives the output. Removing an unused column is stronger minimization than merely masking it.

In-browser processing reduces transfer exposure but does not manage source copies on disk, synchronized folders, backups, or download history. Retention and authorization remain separate controls.

Separate candidate detection from identity verification

Regex can find email or phone format candidates. Checksums for Turkish IDs and payment cards reject some random numbers. Neither proves that an account is active, a number is assigned, or a person owns it.

False positives may mask order codes or examples; alternate formatting and organization-specific identifiers may escape detection. Treat results as candidates and review changed cells.

• Review column names together with values.
• Never treat a checksum as proof of ownership.
• Measure false positives and negatives on a representative sample.

Manage CSV dialect boundaries

CSV is not one universal dialect. Delimiters, quoted line breaks, BOMs, and character encodings differ. Check unique headers and column consistency before export.

Spreadsheet formula injection also matters. Applications may interpret cells beginning with =, +, -, or @ as formulas. Use safe import controls and force suspect cells to text when reopening exports.

Review output with evidence

Keeping values as strings avoids corrupting leading zeros or identifiers through automatic type inference. Apply explicit schema-driven conversion later when types are known.

Before download, compare row and column counts, changed cells, and per-mask totals with expected structure. For high-risk data, add peer review, sampling records, and a deletion plan. Automated masking is not a compliance certificate.