Method types

Cloud Data Loss Prevention (DLP) includes different types of methods that you can use to inspect or transform your data. Using these different methods, you can inspect data both on and off Google Cloud and optimize Cloud DLP behavior for different types of workloads.

Cloud DLP provides the following method types:

Content methods

Content methods are synchronous, stateless methods. The data to be inspected or transformed is sent directly in the request to the DLP API. Cloud DLP inspection findings or transformed data is returned in the API response. Request data is encrypted in transit and is not persisted.

Diagram of content methods dataflow, showing a client sending data via an
API request to Cloud DLP, which can inspect and classify or
de-identify and transform the data, sending a synchronous API response to the
client.

To learn more, explore the REST API reference for content methods:

Storage methods

Storage methods are designed to inspect data stored on Google Cloud in systems like Cloud Storage, BigQuery, and Datastore. To enable storage inspection, you create a Cloud DLP job using the dlpJobs resource. Each job runs as a managed service to inspect data and then perform DLP actions such as save or publish findings. In addition to these optional actions, Cloud DLP creates and persists details about the job including job status, bytes scanned, and summary findings per infoType. You can manage jobs using the DLP API or Cloud DLP in the Google Cloud Console.

Diagram of storage methods dataflow, showing Cloud DLP inspecting
data on a Google Cloud storage repository, and then either saving or publishing
findings.

To learn more, explore the REST API reference for storage methods:

Hybrid methods

Hybrid methods are a set of asynchronous API methods that allow you to scan payloads of data sent from virtually any source for sensitive information and store the findings in Google Cloud. Hybrid methods are similar to content methods in that the data you want to inspect is included in one or more inspection requests; however, unlike content methods, hybrid methods do not return inspection results in the API response. Instead, inspection results are processed server-side asynchronously and results are tabulated and stored in a manner similar to storage methods.

To enable hybrid inspection, you create a Cloud DLP job using the dlpJobs resource. Each hybrid job runs as a managed service to listen for inspection requests and performs DLP actions such as save or publish findings. In addition to these optional actions, Cloud DLP creates and persists details about the job including job status, bytes scanned, and summary findings per infoType. You can manage jobs using the DLP API or Cloud DLP in the Google Cloud Console.

Diagram of hybrid jobs dataflow, showing your application sending data from
an external source to Cloud DLP, Cloud DLP inspecting
the data, and then either saving or publishing
findings.

What's next