A computer program comprising computer-executable instructions for executing on a computer system a computer process, the computer process comprising: evaluating masking operations on tables in a source database to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation, a complex masking operation being a masking operation that requires processing at a client; responsive to determining that the at least one masking operation is a complex masking operation, executing the at least one masking operation by: adding a temporary key column with unique values to the candidate table of the masked database; generating a temporary table including the temporary key column and an empty masked column of the masked database; sending, to the client, one or more data values from the particular column of the candidate table of the masked database to cause the client to generate masked values for the particular column based on the one or more received data values; communicating back the masked values to the source database ; populating the masked values for the particular column in the empty masked column of the temporary table of the masked database; and performing a query operation to restore masked values from the temporary table to the particular column of the candidate table using the temporary key column of the candidate table and the temporary key column of the temporary table. evaluating masking operations on tables in a source database to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation, a complex masking operation being a masking operation that requires processing at a client; responsive to determining that the at least one masking operation is a complex masking operation, executing the at least one masking operation by: adding a temporary key column with unique values to the candidate table of the masked database; generating a temporary table including the temporary key column and an empty masked column of the masked database; sending, to the client, one or more data values from the particular column of the candidate table of the masked database to cause the client to generate masked values for the particular column based on the one or more received data values; communicating back the masked values to the source database ; populating the masked values for the particular column in the empty masked column of the temporary table of the masked database; and adding a temporary key column with unique values to the candidate table of the masked database; generating a temporary table including the temporary key column and an empty masked column of the masked database; sending, to the client, one or more data values from the particular column of the candidate table of the masked database to cause the client to generate masked values for the particular column based on the one or more received data values; communicating back the masked values to the source database ; populating the masked values for the particular column in the empty masked column of the temporary table of the masked database; and performing a query operation to restore masked values from the temporary table to the particular column of the candidate table using the temporary key column of the candidate table and the temporary key column of the temporary table. <EOS>