Zendesk Now Masks Personal Data in Ticket Comments. Here's What Agents Give Up.

On 27 October 2026, Zendesk extended its data masking feature from user fields into ticket comments. For teams that handle sensitive customer data, it closes a real gap. It also comes with trade-offs, and Zendesk's announcement is unusually direct about them. Those trade-offs are worth understanding whether you use Zendesk or not, because they apply to any helpdesk that hides personal data from the people working the queue.

What changed

Zendesk's announcement opens: "Data masking can now extend to personal information in ticket comments, giving admins more control over which agents can see end-user names, phone numbers, and email addresses."

It is not a change to how Zendesk behaves for everyone. In Zendesk's words, "This feature applies to customers using the Advanced Data Privacy and Protection add-on with data masking enabled." It is also scoped by role: "For agents in custom roles with data masking enabled, detected names, phone numbers, and email addresses are masked in live and non-live ticket comments in Support." Admins decide how far it goes: they "can choose whether data masking applies to user fields only or to both user fields and ticket comments."

The reason is a gap most support leads will recognise. As Zendesk puts it, "End users may include personal information in a ticket comment, even when that information is already hidden in their user fields." Customers paste their phone number into a message, or sign off with their full name, and masking the profile alone does not cover that.

The trade-offs, in Zendesk's own words

1. Search. This is the one with the most day-to-day impact: "Agents with data masking enabled won’t be able to find masked tickets by searching for PII that was detected in a comment." Searching for a phone number or an email address a customer mentioned is one of the quickest ways to find a conversation. For agents in a masked role, that route no longer works when the detail sits inside a comment. The sentence is specific to PII detected in comments. It does not say agents lose every way of finding a ticket.

2. Detection can be wrong. "Because masking relies on automated detection, some text that is not PII may occasionally be masked by mistake." Masking that depends on detection will sometimes hide something an agent needed to read, and the agent may not be able to tell what was there.

3. Not every surface is covered. "Side conversations and voice comments are not included." If your team uses either, personal data there is not masked by this feature.

4. A short delay on new messages. "New live messages may briefly show a loading indicator while they’re processed for masking."

5. Side effects of turning masking on. Zendesk's configuration article lists permission changes that come with it. "Explore permissions will be set to No access for roles with data masking turned on to prevent agents from accessing sensitive data in reports." And "Account assumption and deletion will be turned off for agents with permission to manage end users." It also notes that messaging ticket subject lines include the customer's name by default, and recommends switching them to show the end-user ID instead. That change "applies to new tickets only".

What to decide before you turn it on

Zendesk's own advice is to "Configure masking permissions based on the principle of least privilege" and to "test in a sandbox environment to verify that masking rules are working as intended across all relevant areas." In practice, a few questions are worth answering first:

• How will agents in masked roles find a returning customer? If they used to search by phone number or email, agree what they search by instead, such as a ticket number or an order reference, before the switch.
• Who covers side conversations and calls? If personal data in those surfaces must also be restricted, that needs a separate answer.
• What happens when something is masked by mistake? Decide who can see the unmasked text and how an agent asks for help without working around the control.
• Who still needs reports? Masked roles lose access to Explore, so reporting may need to move to a role that is not masked.

The general point

Privacy controls have an operating cost. Hiding personal data from agents protects customers, and it also removes some of the handles agents use to find and understand a conversation. Zendesk has spelled those costs out plainly, which makes this a useful checklist for any team weighing data masking in any tool: decide which roles truly need it, test the workflows it changes, and plan for the cases it does not cover.

DeskLeap is a ticketing, live chat and knowledge base platform. The platform is 100% free with unlimited human agents; an optional AI Agent add-on is $29/mo each.

Sources

Zendesk, Announcing data masking for ticket comments (ADPP add-on) (announced and rolled out 27 October 2026; edited 28 October 2026; read 29 October 2026). Zendesk, Turning on and configuring data masking (ADPP add-on) (updated 27 October 2026; read 29 October 2026). Quotations are verbatim from those pages.