How-to guides

Authentication

• Authenticating to the DLP API

  Learn how to specify an API key or use service accounts to access the DLP API.

Inspection

• Inspecting text for sensitive data

  Detect and classify sensitive information contained within text strings and text files.

• Inspecting structured text for sensitive data

  Detect and classify sensitive information contained within structured text strings.

• Inspecting images for sensitive data

  Detect and classify sensitive information contained within images.

• Inspecting storage and databases for sensitive data

  Detect and classify sensitive information contained within content stored in Google Cloud Storage, Datastore, and BigQuery.

• Inspecting data from external sources using hybrid jobs

  Learn how to use hybrid jobs and job triggers to stream data from virtually any source, inspect the data for sensitive information, save the inspection scan results to a hybrid job resource, and run an action to send the results to another Google Cloud product for analysis.

• Creating inspection templates

  Use templates to create and persist inspect job configuration information.

Data profiling

• Work with data profiles

  View the workflow for using data profiles.

• Profile data in a single project

  Configure data profiling at the project level.

• Profile data in an organization or folder

  Configure profiling at the level of an organization or folder.

• Grant data profiling access to a service agent

  Grant the required role to a service agent so that it can be used to profile data at the organization or folder level.

• View the data profiles in the Google Cloud console

  View project data profiles, table data profiles, and column data profiles in the console.

• Analyze data profiles

  View example SQL queries that you can use to learn more about your BigQuery data. Learn about how to visualize data profiles in Google Data Studio.

• Remediate findings from the data profiler

  Address findings from the data profiler.

• Manage scan configurations

  View, pause, resume, edit, and delete an existing scan configuration.

• Troubleshoot issues with the data profiler

  Resolve issues that you encounter when using the data profiler.

InfoType detectors

• Listing built-in infoType detectors

  Programmatically retrieve a list of all currently supported built-in infoType detectors.

• Creating custom infoType detectors

  Create your own information type detectors to use for inspection and redaction.

• Creating a regular custom dictionary detector

  Create your own regular dictionary custom detectors to use for inspection and redaction.

• Creating a stored custom dictionary detector

  Create large dictionary custom detectors to inspect storage repositories.

• Creating a custom regex detector

  Create your own regular expression detectors to use for inspection and redaction.

• Modifying infoType detectors to refine scan results

  Refine the scan results that Cloud DLP returns by modifying the detection mechanism of a given infoType detector.

• Customizing match likelihood

  Use hotword context rules to extend your custom infoType detectors.

De-identification

• De-identifying sensitive data in text content

  Detect and de-identify sensitive data in text content. This topic describes the different transformation methods available in Cloud DLP.

• Redacting sensitive data from images

  Redact sensitive information from images.

• De-identify sensitive data stored in Cloud Storage using the Google Cloud console

  In the console, inspect a Cloud Storage directory and create de-identified copies of the supported files.

• Creating a wrapped key

  Create a wrapped key for the purpose of de-identifying and re-identifying content.

• Creating de-identification templates

  Use templates to create and persist de-identification job configuration information.

Re-identification risk analysis

• Measuring re-identification and disclosure risk

  Compute the likelihood that de-identified data will be re-identified, the risk of sensitive attribute disclosure, and the risk of dataset membership disclosure.

• Computing k-anonymity for a dataset

  Learn how to compute the _k_-anonymity metric, a property of a dataset that indicates the re-identifiability of its records.

• Computing l-diversity for a dataset

  Learn how to compute the _l_-diversity metric, an extension of _k_-anonymity that measures the diversity of sensitive values for each column in which they occur.

• Computing k-map for a dataset

  Learn how to compute the _k_-map metric, which is very similar to _k_-anonymity except that it assumes that the attacker most likely doesn't know who is in the dataset.

• Computing δ-presence for a dataset

  Learn how to compute the _δ_-presence metric, which quantifies the probability that an individual belongs to an analyzed dataset.

• Visualizing re-identification risk using Google Data Studio

  Measure the k-anonymity of a dataset using Cloud Data Loss Prevention and visualize it in Data Studio to determine the re-identifiability of the data.

• Computing numerical and categorical statistics

  Compute numerical and categorical numerical statistics for individual columns in BigQuery tables.

Scheduling jobs

• Creating job triggers

  Set off Cloud DLP scan jobs automatically by setting up job triggers.

Working with DLP scan results

• Sending Cloud DLP scan results to Data Catalog

  Instruct Cloud DLP to send results directly to Data Catalog.

• Sending Cloud DLP scan results to Security Command Center

  Instruct Cloud DLP to send results directly to Security Command Center.

• Analyzing and reporting on Cloud DLP scan findings

  Generate reports and run rich SQL analytics based on Cloud DLP scan findings.

Security

• Securing Cloud DLP resources

  Learn how to secure Cloud DLP resources using VPC Service Controls.