De-identification of data

1. A computer program product for dynamically de-identifying sensitive data from a data source for a target application, the computer program product comprising a computer readable storage device having computer readable program code embodied therewith, the computer readable program code being configured to cause a hardware processor to:

generate a default rule set including at least one rule, the default rule set including a default de-identification protocol to produce de-identified data from an Extract/Transform/Load (ETL) tool, wherein the default de-identification protocol is selected based on business rules;

map the default rule set to data definitions each generated by a discovery tool and associated with a corresponding sensitive data element identified in the data;

specify a runtime rule set comprising at least one runtime rule, the runtime rule including a runtime de-identification protocol to produce de-identified data from the ETL tool, wherein the runtime rule set is specified via an interface;

replace the default rule set with the runtime rule set to change the default de-identification protocol to the runtime de-identification protocol at runtime to accommodate changing de-identification requirements of a target environment, and map the runtime rule set to the data definitions, wherein

each data definition includes a data object comprising metadata, including an indicator of a type of sensitive data from among a plurality of types of sensitive data and information indicating the location of the data element within the data source, for that data element, and

each runtime rule is mapped to a corresponding data definition of a sensitive data element based on the type of sensitive data; and

receive the data and the data definitions, and for each data definition:

obtain the runtime rule mapped to that data definition; and

apply the obtained runtime rule to the sensitive data element corresponding to that data definition in the received data and dynamically de-identify the sensitive data element for the target application by the ETL tool at runtime via the runtime de-identification protocol of the obtained runtime rule.

2. The computer program product of claim 1 , wherein the computer readable program code is further configured to cause a hardware processor to:

consume the generated data definitions and apply the default de-identification protocol mapped to the sensitive data element data definition.

3. The computer program product of claim 2 , wherein the computer readable program code is further configured to cause a hardware processor to:

compare the output of applying the default de-identification protocol with the output of applying the runtime de-identification protocol; and

display the comparison for review.

4. The computer program product of claim 2 , wherein the computer readable program code is further configured to cause a hardware processor to selectively re-identify the de-identified data element in accordance with rules to produce an unmasked data element.

5. The computer program product of claim 1 , wherein the replacing further comprises:

overriding the generated default rule set with the runtime rule set, wherein the default rule set and the runtime rule set correspond to different target environments having different de-identification requirements.

6. The computer program product of claim 1 , wherein the computer readable program code is further configured to cause a hardware processor to enable specification of the runtime rule set by designating a file location for the runtime rule set via the interface.

7. The computer program product of claim 1 , wherein the computer readable program code is further configured to cause a hardware processor to enable specification of the runtime rule set via a text box provided on the interface.

8. A system for dynamically de-identifying sensitive data from a data source for a target application, the system comprising a computer system including at least one hardware processor configured to:

generate a default rule set including at least one rule, the default rule set including a default de-identification protocol to produce de-identified data from an Extract/Transform/Load (ETL) tool, wherein the default de-identification protocol is selected based on business rules;

map the default rule set to data definitions each generated by a discovery tool and associated with a corresponding sensitive data element identified in the data;

specify a runtime rule set comprising at least one runtime rule, the runtime rule including a runtime de-identification protocol to produce de-identified data from the ETL tool, wherein the runtime rule set is specified via an interface;

replace the default rule set with the runtime rule set to change the default de-identification protocol to the runtime de-identification protocol at runtime to accommodate changing de-identification requirements of a target environment, and map the runtime rule set to the data definitions, wherein

each data definition includes a data object comprising metadata, including an indicator of a type of sensitive data from among a plurality of types of sensitive data and information indicating the location of the data element within the data source, for that data element, and

each runtime rule is mapped to a corresponding data definition of a sensitive data element based on the type of sensitive data; and

receive the data and the data definitions, and for each data definition:

obtain the runtime rule mapped to that data definition; and

apply the obtained runtime rule to the sensitive data element corresponding to that data definition in the received data and dynamically de-identify the sensitive data element for the target application by the ETL tool at runtime via the runtime de-identification protocol of the obtained runtime rule.

9. The system of claim 8 , wherein the at least one hardware processor is further configured to:

consume the generated data definitions and apply and apply the default de-identification protocol mapped to the sensitive data element data definition.

10. The system of claim 9 , wherein the at least one hardware processor is further configured to:

compare the output of applying the default de-identification protocol with the output of applying the runtime de-identification protocol; and

display the comparison for review.

11. The system of claim 9 , wherein the at least one hardware processor is further configured to selectively re-identify the de-identified data element in accordance with rules to produce an unmasked data element.

12. The system of claim 8 , wherein the replacing further comprises:

overriding the generated default rule set with the runtime rule set, wherein the default rule set and the runtime rule set correspond to different target environments having different de-identification requirements.

13. The system of claim 8 , wherein the at least one hardware processor is further configured to enable specification of the runtime rule set by designating a file location for the runtime rule set via the interface.

14. The system of claim 8 , wherein the at least one hardware processor is further configured to enable specification of the runtime rule set via a text box provided on the interface.

15. The computer program product of claim 1 , wherein each data definition is in the form of an Extensible Markup Language (XML) file.

16. The system of claim 8 , wherein each data definition is in the form of an Extensible Markup Language (XML) file.

17. A system for dynamically de-identifying sensitive data from a data source for a target application, the system comprising a computer system including at least one hardware processor configured to:

identify sensitive data elements in the data via a discovery tool, wherein identifying a sensitive data element comprises associating the data element with a type of sensitive data from among a plurality of types of sensitive data;

generate data definitions via the discovery tool, wherein each data definition is associated with an identified sensitive data element and includes a data object comprising metadata, including an indicator of a type of sensitive data and information indicating the location of the data element within the data source, for that data element;

specify a default rule set comprising at least one runtime rule, the default rule set including a default de-identification protocol to produce de-identified data from an Extract/Transform/Load (ETL) tool, wherein the default de-identification protocol is selected based on business rules;

map the default rule set to the data definitions generated by the discovery tool for the identified sensitive data elements;

replace the default rule set with a runtime rule set comprising at least one runtime rule, the runtime rule including a runtime de-identification protocol to produce de-identified data from the ETL tool, wherein the runtime rule set is specified via an interface and the replacing changes the default de-identification protocol to the runtime de-identification protocol at runtime to accommodate changing de-identification requirements of a target environment;

map the runtime rule set to the data definitions generated by the discovery tool and associated with a corresponding sensitive data element identified in the data, wherein each runtime rule is mapped to a corresponding data definition of a sensitive data element based on the type of sensitive data; and

receive the data and the data definitions, and for each data definition:

obtain the runtime rule mapped to that data definition; and

apply the obtained runtime rule to the sensitive data element corresponding to that data definition in the received data and dynamically de-identify the sensitive data element for the target application by the ETL tool at runtime via the runtime de-identification protocol of the obtained runtime rule.