How-to guides

Authentication

• Authenticating to the Cloud DLP API

  Learn how to specify an API key or use service accounts to access the Cloud DLP API.

Inspection

• Inspecting text for sensitive data

  Detect and classify sensitive information contained within text strings and text files.

• Inspecting structured text for sensitive data

  Detect and classify sensitive information contained within structured text strings.

• Inspecting images for sensitive data

  Detect and classify sensitive information contained within images.

• Inspecting storage and databases for sensitive data

  Detect and classify sensitive information contained within content stored in Google Cloud Storage, Datastore, and BigQuery.

• Inspecting data from external sources using hybrid jobs

  Learn how to use hybrid jobs and job triggers to stream data from virtually any source, inspect the data for sensitive information, save the inspection scan results to a hybrid job resource, and run an action to send the results to another Google Cloud product for analysis.

• Creating inspection templates

  Use templates to create and persist inspect job configuration information.

InfoType detectors

• Listing built-in infoType detectors

  Programmatically retrieve a list of all currently supported built-in infoType detectors.

• Creating custom infoType detectors

  Create your own information type detectors to use for inspection and redaction.

• Creating a regular custom dictionary detector

  Create your own regular dictionary custom detectors to use for inspection and redaction.

• Creating a stored custom dictionary detector

  Create large dictionary custom detectors to inspect storage repositories.

• Creating a custom regex detector

  Create your own regular expression detectors to use for inspection and redaction.

• Modifying infoType detectors to refine scan results

  Refine the scan results that Cloud DLP returns by modifying the detection mechanism of a given infoType detector.

• Customizing match likelihood

  Use hotword context rules to extend your custom infoType detectors.

De-identification

• De-identifying sensitive data in text content

  Detect and de-identify sensitive data in text content.

• Redacting sensitive data from images

  Redact sensitive information from images.

• Creating a wrapped key

  Create a wrapped key for the purpose of de-identifying and re-identifying content.

• Creating de-identification templates

  Use templates to create and persist de-identification job configuration information.

Re-identification risk analysis

• Measuring re-identification and disclosure risk

  Compute the likelihood that de-identified data will be re-identified, the risk of sensitive attribute disclosure, and the risk of dataset membership disclosure.

• Computing k-anonymity for a dataset

  Learn how to compute the _k_-anonymity metric, a property of a dataset that indicates the re-identifiability of its records.

• Computing l-diversity for a dataset

  Learn how to compute the _l_-diversity metric, an extension of _k_-anonymity that measures the diversity of sensitive values for each column in which they occur.

• Computing k-map for a dataset

  Learn how to compute the _k_-map metric, which is very similar to _k_-anonymity except that it assumes that the attacker most likely doesn't know who is in the dataset.

• Computing δ-presence for a dataset

  Learn how to compute the _δ_-presence metric, which quantifies the probability that an individual belongs to an analyzed dataset.

• Visualizing re-identification risk using Google Data Studio

  Measure the k-anonymity of a dataset using Cloud Data Loss Prevention (DLP) and visualize it in Data Studio to determine the re-identifiability of the data.

• Computing numerical and categorical statistics

  Compute numerical and categorical numerical statistics for individual columns in BigQuery tables.

Scheduling jobs

• Creating job triggers

  Set off Cloud DLP scan jobs automatically by setting up job triggers.

Working with DLP scan results

• Sending Cloud DLP scan results to Data Catalog

  Instruct Cloud DLP to send results directly to Data Catalog.

• Sending Cloud DLP scan results to Security Command Center

  Instruct Cloud DLP to send results directly to Security Command Center.

• Analyzing and reporting on Cloud DLP scan findings

  Generate reports and run rich SQL analytics based on Cloud DLP scan findings.

Security

• Securing Cloud DLP resources

  Learn how to secure Cloud DLP resources using VPC Service Controls.