Sensitivity and data risk levels

This page describes the data risk and sensitivity levels that Sensitive Data Protection assigns to data profiles. To understand the data risk levels, it's important to understand the sensitivity levels first.

Note: When generating data profiles, Sensitive Data Protection scans for only the infoTypes that you specify in your inspection template. For example, suppose credit card numbers are present in a column. If the CREDIT_CARD_NUMBER infoType isn't listed in your inspection template, then the resulting sensitivity and data risk levels for that column don't reflect the presence of credit card numbers.

Sensitivity level

Sensitivity level is an indication of how sensitive the data in a project, table, or file store is. Data is sensitive if it contains detected elements, such as personally identifiable information (PII), financial data, and credentials.

A data profile can have any of the following sensitivity levels:

High

Highly sensitive personal information might be present, including credit card numbers and certain national identifiers.

Moderate

Sensitive information that is not classified as highly sensitive might be present. Examples are email addresses and phone numbers, which can be considered personally identifiable. The data might also include freeform text or unstructured data, such as comments.

Low

Sensitive information wasn't detected, and the data doesn't include freeform text or unstructured data.

Data risk level

Data risk level is the risk associated with the data in its current state. It considers the sensitivity level of the data in the resource and the presence of access controls to protect that data.

High

High-sensitivity data might be present, and there are no access controls to restrict data exposure. Alternatively, moderate or high-sensitivity data is widely accessible.

Moderate

Moderate-sensitivity data might be present, and there are no access controls to restrict data exposure.

Low

The sensitivity level of the data is low. Alternatively, access to the data has been further restricted, for example, through access controls.

A profiled data asset can also get a Low data risk level if you enabled automatic tagging and opted to automatically set the data risk of the profiled data assets to Low.

Sensitivity calculation

To calculate sensitivity, Sensitive Data Protection considers the following:

• The likelihood that highly sensitive infoTypes are present.
• Whether the data has an unstructured format and contains mostly freeform text, like comments.

Data risk calculation

To calculate data risk, Sensitive Data Protection considers the following:

• The calculated sensitivity level of the data.
• The presence of access controls that limit access to the data.
• Whether discovery is configured to set the data risk level to Low when automatic tagging is enabled. For more information, see Enable the automatic tagging in the discovery configuration.