NZ data security company DataMasque looks to AWS SCA, increasing regulations to supercharge growth in 2026

DataMasque, a New Zealand-founded and headquartered data security company, is ramping up investment in both its staff and solutions in 2026 off the back of a strategic collaboration agreement (SCA) signed with AWS at the end of last year.

CEO and co-founder Grant de Leeuw said that SCAs are "quite hard to get", so DataMasque - which automates the discovery and masking of sensitive data within enterprises and governments, generating synthetically identical customer data in its place - is "very fortunate" to be selected.

"The massive opportunity we have, and what AWS sees, is if organisations are building their own models, they can now start training it on their deidentified, masked customer data," he explained.

"The SCA has committed marketing funds, helping with proof of concepts for customers and go-to-market initiatives with AWS."

DataMasque's tool, which can integrate not just with AWS but also Cohesity, means that the synthetically identical customer data looks and behaves like real data, so applications, AI models and tests function as expected.

It also maintains relationships and consistency across tables, files, databases and environments and crucially, the company claims, cannot be reverse-engineered back to real customer data, ensuring compliance with GDPR, ISO27001, the Australian Privacy Act and other privacy-focused regulations.

"It's a high-fidelity mask where you get all the same value after masking as if it's customer data, but none of the risks," de Leeuw told techpartner.news.

"It no longer falls under data sovereignty challenges. There's no data breach risk anymore. There's no legislation challenges around testing with real customer data."

That legislation challenge has become more prominent in recent years with the introduction of APRA's CPS 230 standard around operational risk management last year, and the CPS 234 standard around information security before that, something that de Leeuw said he is in support of.

"Because of APRA in Australia, a lot of companies have, rightly so, restricted access to data, and these teams are saying 'how are we meant to do our job?'. That's been one of the big unlocks for us - we work with one of the big four banks in Australia, some of the insurers, government - [as] what we're allowing our customers to do is finally start giving high quality data to those internal teams," he said.

"I really like the APRA regulations; I think they're quite prescriptive, which is often missing from a lot of these things. What's happening in India right now with the DPDP Act is big; Quebec's Law 25 is extremely stringent; [with] CCPA, it'll be a 6000 US dollar infringement per record lost.

"These are huge numbers. Australia needed to make change after the Optus breach, Medibank breach, Latitude breach - there was records within Latitude that were 20 plus years old - so it is right that these organisations are now being audited to see if they have purged some of that older data."

The company is planning to ramp up its team this year, not only adding more engineers as it builds out its product further - which can be deployed on-prem, via Azure or OCI - but also adding more sales and go-to-market capabilities too.

"We have got a few open hires in North America, but also in Australia and New Zealand; India is a massive growing market for us [too] because of the legislation going on there," de Leeuw said.

With four people already in-country in the US and a team of 22 globally - plus the ambition to bring on close to 15 new hires in 2026 alone - de Leeuw said he is "really proud" of not only what the company has built since launching five years ago, but also in the fact that it's a company from the ANZ region, now with an international presence.

"[We're] also really doubling down on our partnership with AWS and in 2026, we will be leveraging the work we've done in the last couple of years to really start aligning around helping organisations leverage their customer data in a safe and secure manner for their AI use cases" he explained.

De Leeuw said that the company, which counts the likes of ADP, Best Western, JLL, the NZ government and the Victorian state government among its customers, was started due to a belief that a lot of solutions in the market were solving privacy, but not data utility.

"What happens a lot with other deidentification solutions [is] they'll strip out all the usability of that data; they're just solving for privacy, and then you can't really use it," he stated to techpartner.news.

"We built this because we knew a lot of bugs that occur [are] because of edge cases in software testing. You need to maintain those edge cases in your data, so when you actually turn the thing on you know its going to work."