Assign the 'Unmasked Admin' group to users to grant them full rights to view unmasked fields, edit configurations, and create masking rules.

Configure a user with 'Masked User' rights to mask their access to sensitive data and restrict them from creating or defining masking rules.

Navigate to General Settings and enable the 'Enable Sensitive Masking' option to globally activate the data masking features.

Go to Technical settings and open the 'Sensitive Mask Rules' menu under the Sensitive Masking section.

Create a new masking rule for the Contact model (res.partner) specifying the fields to mask and the mask type.

Define the active model, select the fields to mask, choose from various pre-defined mask types, and apply domain filters to target specific records for masking.

Select the desired mask type from the dropdown list to apply specific formatting rules for the selected fields.

Observe the contact list view as a masked user where the Name, Email, and Phone fields are displayed with mask characters.

View the contact form as a masked user to ensure sensitive details in both main and sub-contacts are masked.

Select the 'Identifier (keep edges)' mask type to configure specific numbers of characters to reveal at the start and end of the field value.

Verify that the contact list displays with the first two and last two characters visible in Name, Email, and Phone fields, while the rest are masked.

Confirm that the contact form view displays the partially masked fields keeping the start and end characters visible for both main contact and sub-contacts.

Apply a domain filter to the masking rule to target specific records, such as restricting the rule only to the contact with ID 42.

Confirm that other contact records display normally without masking since they do not meet the domain criteria.

Verify that only the contact with ID 42 has its Name, Email, and Phone fields masked according to the defined domain rule.

Open the form view of the contact with ID 42 to verify that the Name, Email, and Phone fields are masked as expected.

Verify that when a masked field is used in a many2one relation (such as the Customer field on a Sale Order), the data remains masked.

Configure export logging settings to log sensitive exports, define data leak alert thresholds for email notifications, and set automatic retention periods for logs cleanup.

Select the sensitive fields in the Export Data wizard and click the 'Export' button to generate the data file.

Navigate to Technical settings and open the 'Sensitive field export log' menu to view records of all sensitive data export operations.

View the list of sensitive field export logs, displaying details like date, exporting user, model name, sensitive fields list, and export format.

Open a specific sensitive field export log entry to analyze the audit details, including the exporting user, IP address, and list of sensitive fields.