Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Menggunakan Perlindungan Data Sensitif untuk memindai data BigQuery
Mengetahui lokasi data sensitif Anda sering kali menjadi langkah pertama dalam memastikan bahwa data tersebut diamankan dan dikelola dengan benar. Pengetahuan ini dapat membantu mengurangi risiko pengungkapan detail sensitif, seperti nomor kartu kredit, informasi medis, nomor Jaminan Sosial, nomor surat izin mengemudi, alamat, nama lengkap, dan rahasia perusahaan. Pemindaian data secara berkala juga dapat membantu Anda memenuhi persyaratan kepatuhan dan memastikan kepatuhan pada praktik terbaik seiring perkembangan dan perubahan data. Untuk membantu memenuhi persyaratan kepatuhan, gunakan Perlindungan Data Sensitif untuk memeriksa tabel BigQuery dan membantu melindungi data sensitif Anda.
Ada dua cara untuk memindai data BigQuery Anda:
Pembuatan profil data sensitif. Perlindungan Data Sensitif dapat membuat profil tentang data BigQuery di seluruh organisasi, folder, atau project. Profil
data berisi metrik dan metadata tentang tabel Anda serta membantu
menentukan lokasi data sensitif dan
berisiko tinggi. Perlindungan Data Sensitif melaporkan metrik ini di tingkat project, tabel, dan kolom. Untuk informasi selengkapnya, baca Profil data untuk data BigQuery.
Pemeriksaan on-demand. Perlindungan Data Sensitif dapat melakukan pemeriksaan mendalam pada satu tabel atau subset kolom dan melaporkan temuannya hingga ke tingkat sel. Pemeriksaan semacam ini dapat membantu Anda mengidentifikasi setiap instance jenis data tertentu, seperti lokasi akurat nomor kartu kredit di dalam sel tabel. Anda dapat melakukan pemeriksaan on-demand melalui halaman Perlindungan Data Sensitif di konsolGoogle Cloud , halaman BigQuery di konsol Google Cloud , atau secara terprogram melalui DLP API.
Halaman ini menjelaskan cara melakukan pemeriksaan on-demand melalui halaman BigQuery di konsol Google Cloud .
Perlindungan Data Sensitif adalah layanan terkelola sepenuhnya yang memungkinkan Google Cloud pelanggan
mengidentifikasi dan melindungi data sensitif dalam skala besar. Perlindungan Data Sensitif menggunakan lebih dari 150 detektor bawaan untuk mengidentifikasi pola, format, dan checksum.
Perlindungan Data Sensitif juga menyediakan serangkaian alat untuk melakukan de-identifikasi data Anda, termasuk penyamaran, tokenisasi, pseudonimisasi, perubahan tanggal, dan lainnya, tanpa mereplikasi data pelanggan.
Untuk mempelajari Perlindungan Data Sensitif lebih lanjut, lihat dokumentasi
Perlindungan Data Sensitif.
Pastikan pengguna yang membuat tugas Perlindungan Data Sensitif diberikan peran IAM Perlindungan Data Sensitif bawaan yang sesuai atau
izin yang memadai untuk menjalankan tugas
Perlindungan Data Sensitif.
Memindai data BigQuery menggunakan konsol Google Cloud
Untuk memindai data BigQuery, buat tugas Perlindungan Data Sensitif yang menganalisis tabel. Anda dapat memindai tabel BigQuery dengan cepat menggunakan opsi Scan with Sensitive Data Protection di konsol Google Cloud BigQuery.
Untuk memindai tabel BigQuery menggunakan Perlindungan Data Sensitif:
Di panel Explorer, luaskan project dan set data Anda, lalu pilih tabel.
Klik Export > Scan with Sensitive Data Protection. Halaman pembuatan tugas Perlindungan Data Sensitif
akan terbuka di tab baru.
Untuk Langkah 1: Pilih data input, masukkan ID tugas. Nilai di bagian
Location dihasilkan secara otomatis. Selain itu, bagian Sampling
dikonfigurasi otomatis untuk menjalankan pemindaian sampel terhadap data Anda, tetapi
Anda dapat menyesuaikan setelan sesuai kebutuhan.
Klik Continue.
Opsional: Untuk Langkah 2: Konfigurasikan deteksi, Anda dapat mengonfigurasi jenis data yang akan ditelusuri, yang disebut infoTypes.
Lakukan salah satu hal berikut:
Untuk memilih dari daftar infoTypes bawaan, klik Manage
infoTypes. Kemudian, pilih infoTypes yang ingin Anda telusuri.
Untuk menggunakan template pemeriksaan yang sudah ada,
di kolom Template name, masukkan nama resource lengkap template.
Untuk informasi selengkapnya tentang infoTypes, lihat
detektor InfoType dan infoType dalam
dokumentasi Perlindungan Data Sensitif.
Klik Continue.
Opsional: Untuk Langkah 3: Tambahkan tindakan, aktifkan Save to BigQuery untuk memublikasikan temuan Perlindungan Data Sensitif ke tabel BigQuery. Jika Anda tidak menyimpan temuan, tugas yang selesai hanya akan berisi
statistik tentang jumlah temuan dan infoTypes-nya. Menyimpan temuan ke BigQuery akan menyimpan detail tentang lokasi presisi dan keyakinan setiap temuan.
Opsional: Jika Anda mengaktifkan Save to BigQuery, di bagian Save to
BigQuery, masukkan informasi berikut:
Project ID: project ID tempat hasil Anda disimpan.
Dataset ID: nama set data yang menyimpan hasil Anda.
Opsional: Table ID: nama tabel yang menyimpan hasil
Anda. Jika tidak ada ID tabel yang ditentukan, nama default akan ditetapkan ke
tabel baru yang mirip dengan berikut ini:
dlp_googleapis_date_1234567890.
Jika Anda menentukan tabel yang sudah ada, temuan akan ditambahkan ke tabel tersebut.
Untuk menyertakan konten aktual yang terdeteksi, aktifkan Include quote.
Klik Continue.
Opsional: Untuk Langkah 4: Jadwalkan, konfigurasikan rentang waktu atau jadwal dengan
memilih antara Specify time span atau Create a trigger to run the job
on a periodic schedule.
Klik Continue.
Opsional: Di halaman Review, periksa detail tugas Anda. Jika perlu,
sesuaikan setelan sebelumnya.
Klik Create.
Setelah tugas Perlindungan Data Sensitif selesai, Anda akan dialihkan ke halaman detail tugas, dan Anda akan diberi tahu melalui email. Anda dapat melihat hasil
pemindaian di halaman detail tugas, atau mengklik link ke
halaman detail tugas Perlindungan Data Sensitif di email penyelesaian tugas.
Jika Anda memilih untuk memublikasikan temuan Perlindungan Data Sensitif ke BigQuery, pada halaman Job details, klik View Findings in BigQuery untuk membuka tabel di konsol Google Cloud . Anda kemudian dapat membuat kueri
pada tabel dan menganalisis temuan Anda. Untuk informasi selengkapnya tentang cara membuat kueri hasil di BigQuery, lihat Membuat Kueri temuan Perlindungan Data Sensitif di BigQuery dalam dokumentasi Perlindungan Data Sensitif.
Jika Anda ingin menyamarkan atau melakukan de-identifikasi data sensitif yang ditemukan oleh pemindaian Perlindungan Data Sensitif, lihat bagian berikut:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-17 UTC."],[[["\u003cp\u003eSensitive Data Protection can scan BigQuery data to identify sensitive information, including credit card numbers, medical details, and other personal data, helping ensure its proper security and management.\u003c/p\u003e\n"],["\u003cp\u003eThere are two primary methods for scanning BigQuery data: sensitive data profiling, which provides an overview of data sensitivity across an organization, and on-demand inspection, which offers deep analysis of specific tables or columns down to the cell level.\u003c/p\u003e\n"],["\u003cp\u003eOn-demand inspections can be initiated from the BigQuery page in the Google Cloud console, allowing users to quickly analyze a table for sensitive data and configure what data types to look for.\u003c/p\u003e\n"],["\u003cp\u003eAfter completing a scan, Sensitive Data Protection can save the findings to a BigQuery table, including precise locations and confidence levels of sensitive data, providing detailed insights for further analysis or action.\u003c/p\u003e\n"],["\u003cp\u003eThe DLP API is required to be enabled, and users running Sensitive Data Protection jobs need appropriate IAM roles or permissions.\u003c/p\u003e\n"]]],[],null,["# Using Sensitive Data Protection to scan BigQuery data\n=====================================================\n\nKnowing where your sensitive data exists is often the first step in ensuring\nthat it is properly secured and managed. This knowledge can help reduce the risk\nof exposing sensitive details such as credit card numbers, medical information,\nSocial Security numbers, driver's license numbers, addresses, full names, and\ncompany-specific secrets. Periodic scanning of your data can also help with\ncompliance requirements and ensure best practices are followed as your data\ngrows and changes with use. To help meet compliance requirements, use\nSensitive Data Protection to inspect your BigQuery tables and\nto help protect your sensitive data.\n\nThere are two ways to scan your BigQuery data:\n\n- **Sensitive data profiling.** Sensitive Data Protection can generate profiles about\n BigQuery data across an organization, folder, or project. *Data\n profiles* contain metrics and metadata about your tables and help you\n determine where [sensitive and high-risk\n data](/sensitive-data-protection/docs/sensitivity-risk-calculation) reside. Sensitive Data Protection\n reports these metrics at the project, table, and column levels. For more\n information, see [Data profiles for\n BigQuery data](/sensitive-data-protection/docs/data-profiles).\n\n- **On-demand inspection.** Sensitive Data Protection can perform a deep inspection on\n a single table or a subset of columns and report its findings down to the cell\n level. This kind of inspection can help you identify individual instances of\n specific data [types](/sensitive-data-protection/docs/infotypes-reference), such as the precise\n location of a credit card number inside a table cell. You can do an on-demand\n inspection through the Sensitive Data Protection page in the\n Google Cloud console, the **BigQuery** page in the Google Cloud console,\n or programmatically through the DLP API.\n\nThis page describes how to do an on-demand inspection through the\n**BigQuery** page in the Google Cloud console.\n\nSensitive Data Protection is a fully managed service that lets Google Cloud customers\nidentify and protect sensitive data at scale. Sensitive Data Protection uses more\nthan 150 predefined detectors to identify patterns, formats, and checksums.\nSensitive Data Protection also provides a set of tools to de-identify your data\nincluding masking, tokenization, pseudonymization, date shifting, and more, all\nwithout replicating customer data.\n\nTo learn more about Sensitive Data Protection, see the [Sensitive Data Protection](/sensitive-data-protection/docs)\ndocumentation.\n\nBefore you begin\n----------------\n\n1. Get familiar with [Sensitive Data Protection pricing](/sensitive-data-protection/pricing) and [how to keep Sensitive Data Protection costs under control](/sensitive-data-protection/docs/best-practices-costs).\n2. [Enable the DLP API](/apis/docs/enable-disable-apis).\n\n [Enable the API](https://console.cloud.google.com/flows/enableapi?apiid=dlp.googleapis.com)\n3. Ensure that the user creating your Sensitive Data Protection jobs is granted an\n appropriate predefined Sensitive Data Protection [IAM role](/sensitive-data-protection/docs/iam-roles) or\n sufficient [permissions](/sensitive-data-protection/docs/iam-permissions) to run Sensitive Data Protection\n jobs.\n\n| **Note:** When you enable the DLP API, a service account is created with a name similar to `service-`\u003cvar translate=\"no\"\u003eproject_number\u003c/var\u003e`@dlp-api.iam.gserviceaccount.com`. This service account is granted the DLP API Service Agent role, which lets the service account authenticate with the BigQuery API. For more information, see [Service account](/sensitive-data-protection/docs/iam-permissions#service_account) on the Sensitive Data Protection IAM permissions page.\n\nScanning BigQuery data using the Google Cloud console\n-----------------------------------------------------\n\nTo scan BigQuery data, you create a Sensitive Data Protection job\nthat analyzes a table. You can scan a BigQuery table quickly by using\nthe **Scan with Sensitive Data Protection** option in the BigQuery Google Cloud console.\n\nTo scan a BigQuery table using Sensitive Data Protection:\n\n1. In the Google Cloud console, go to the BigQuery page.\n\n [Go to BigQuery](https://console.cloud.google.com/bigquery)\n2. In the **Explorer** panel, expand your project and dataset, then select\n the table.\n\n3. Click **Export \\\u003e Scan with Sensitive Data Protection**. The Sensitive Data Protection job\n creation page opens in a new tab.\n\n4. For **Step 1: Choose input data** , enter a job ID. The values in the\n **Location** section are automatically generated. Also, the **Sampling**\n section is automatically configured to run a sample scan against your data, but\n you can adjust the settings as needed.\n\n5. Click **Continue**.\n\n6. Optional: For **Step 2: Configure detection** , you can configure what types\n of data to look for, called `infoTypes`.\n\n Do one of the following:\n - To select from the list of predefined `infoTypes`, click **Manage\n infoTypes**. Then, select the infoTypes you want to search for.\n - To use an existing [inspection template](/sensitive-data-protection/docs/creating-templates-inspect), in the **Template name** field, enter the template's full resource name.\n\n For more information on `infoTypes`, see\n [InfoTypes and infoType detectors](/sensitive-data-protection/docs/concepts-infotypes) in the\n Sensitive Data Protection documentation.\n7. Click **Continue**.\n\n8. Optional: For **Step 3: Add actions** , turn on **Save to BigQuery**\n to publish your Sensitive Data Protection findings to a BigQuery\n table. If you don't store findings, the completed job contains only\n statistics about the number of findings and their `infoTypes`. Saving\n findings to BigQuery saves details about the precise location and\n confidence of each individual finding.\n\n9. Optional: If you turned on **Save to BigQuery** , in the **Save to\n BigQuery** section, enter the following information:\n\n - **Project ID**: the project ID where your results are stored.\n - **Dataset ID**: the name of the dataset that stores your results.\n - Optional: **Table ID** : the name of the table that stores your results. If no table ID is specified, a default name is assigned to a new table similar to the following: `dlp_googleapis_`\u003cvar translate=\"no\"\u003edate\u003c/var\u003e`_1234567890`. If you specify an existing table, findings are appended to it.\n\n To include the actual content that was detected, turn on **Include quote**.\n10. Click **Continue**.\n\n11. Optional: For **Step 4: Schedule** , configure a time span or schedule by\n selecting either **Specify time span** or **Create a trigger to run the job\n on a periodic schedule**.\n\n12. Click **Continue**.\n\n13. Optional: On the **Review** page, examine the details of your job. If needed,\n adjust the previous settings.\n\n14. Click **Create**.\n\n15. After the Sensitive Data Protection job completes, you are redirected to the job\n details page, and you're notified by email. You can view the results of the\n scan on the job details page, or you can click the link to\n the Sensitive Data Protection job details page in the job completion email.\n\n16. If you chose to publish Sensitive Data Protection findings to\n BigQuery, on the **Job details** page, click **View Findings in\n BigQuery** to open the table in the Google Cloud console. You can then query the\n table and analyze your findings. For more information on querying your results\n in BigQuery, see\n [Querying Sensitive Data Protection findings in BigQuery](/sensitive-data-protection/docs/querying-findings)\n in the Sensitive Data Protection documentation.\n\nWhat's next\n-----------\n\n- Learn more about [inspecting BigQuery and other storage\n repositories for sensitive data using Sensitive Data Protection](/sensitive-data-protection/docs/inspecting-storage).\n\n- Learn more about [profiling data in an organization, folder, or\n project](/sensitive-data-protection/docs/data-profiles).\n\n- Read the Identity \\& Security blog post [Take charge of your data: using\n Sensitive Data Protection to de-identify and obfuscate sensitive\n information](https://cloud.google.com/blog/products/identity-security/taking-charge-of-your-data-using-cloud-dlp-to-de-identify-and-obfuscate-sensitive-information).\n\nIf you want to redact or otherwise de-identify the sensitive data that the\nSensitive Data Protection scan found, see the following:\n\n- [Inspect text to de-identify sensitive information](/sensitive-data-protection/docs/inspect-sensitive-text-de-identify)\n- [De-identifying sensitive data](/sensitive-data-protection/docs/deidentify-sensitive-data) in the Sensitive Data Protection documentation\n- [AEAD encryption concepts in GoogleSQL](/bigquery/docs/aead-encryption-concepts) for information on encrypting individual values within a table\n- [Protecting data with Cloud KMS keys](/bigquery/docs/customer-managed-encryption) for information on creating and managing your own encryption keys in [Cloud KMS](/kms/docs) to encrypt BigQuery tables"]]
