How does my system understand if data got masked?
Data masking occurs just before the data is sent to the client (your program, SSMS, etc).  In that sense, it is &quot;replaced and gone&quot; by the time it gets to a client that is requesting the data to view it (assuming the user accessing the data doesn't have the UNMASK privilege).  Thus, you can perform logic on it in your queries (apply where clauses to it, update it, etc).  But you won't see the real data if you include it in a SELECT statement.
However, the data is still stored on the server unencrypted.  And in fact, you can use this knowledge to figure out exactly what data is in the table - even if you don't have the UNMASK privilege.  See Joe Obbish's great post on that topic here: Dynamic Data Unmasking
The difference between that and something like &quot;Always Encrypted&quot; is that only the encrypted version of the data is stored, and a key must be used to decrypt and use / view the data.