[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Learn about your data through discovery and inspection\n\nThis page describes and compares two Sensitive Data Protection services that\nhelp you understand your data and enable data governance workflows: the\n[discovery service](#discovery) and the [inspection\nservice](#inspection).\n\nSensitive data discovery\n------------------------\n\nThe discovery service monitors data across your organization.\nThis service runs continuously and automatically discovers, classifies, and\nprofiles data. Discovery can help you understand the\nlocation and nature of the data you're storing, including data resources that\nyou might not be aware of. Unknown data (sometimes called *shadow data*)\ntypically doesn't undergo the same level of data governance and risk management\nas known data.\n\nYou configure discovery at various scopes. You can\nset different profiling schedules for different subsets of your data. You\ncan also exclude subsets of data that you don't need to profile.\n\n### Discovery scan output: data profiles\n\nThe output of a discovery scan is a set of [*data\nprofiles*](/sensitive-data-protection/docs/data-profiles) for each data resource in scope. For\nexample, a discovery scan of BigQuery or Cloud SQL data generates\ndata profiles at the project, table, and column levels.\n\nA data profile contains metrics and insights about the profiled resource. It\nincludes the data classifications (or\n[*infoTypes*](/sensitive-data-protection/docs/infotypes-reference)), sensitivity levels, data\nrisk levels, data size, data shape, and other elements that describe the nature\nof the data and its *data security posture* (how secure the data is). You can\nuse data profiles to make informed decisions about how to protect your\ndata---for example, by setting access policies on the table.\n\nConsider a BigQuery column called `ccn`, where each row contains a\nunique credit card number and there are no null values. The generated\ncolumn-level data profile will have the following details:\n\nAdditionally, this column-level profile is part of a [table-level\nprofile](/sensitive-data-protection/docs/metrics-reference#table-data-profile), which provides\ninsights like the data location, encryption status, and whether the table is\nshared publicly. In the Google Cloud console, you can also view the\nCloud Logging entries for the table, and the IAM principals\nwith roles for the table.\n\nFor a full list of metrics and insights available in data profiles, see [Metrics\nreference](/sensitive-data-protection/docs/metrics-reference).\n\n### When to use discovery\n\nWhen you plan your data risk management approach, we recommend that you start\nwith discovery. The discovery service helps you get a broad view of\nyour data and enable [alerting](/sensitive-data-protection/docs/dp-receive-pubsub-messages),\n[reporting](/sensitive-data-protection/docs/analyze-data-profiles), and\n[remediation](/sensitive-data-protection/docs/data-profiles-remediation) of issues.\n\nIn addition, the discovery service can help you identify the resources\nwhere unstructured data might reside. Such resources might warrant an exhaustive\ninspection. Unstructured data is specified by a high [free text\nscore](/sensitive-data-protection/docs/metrics-reference#free-text-score) in a scale from\n0 to 1.\n\nSensitive data inspection\n-------------------------\n\nThe inspection service performs an exhaustive scan of a single resource\nto locate each individual instance of sensitive data. An inspection produces a\n*finding* for each detected instance.\n\n[Inspection jobs](/sensitive-data-protection/docs/creating-job-triggers) provide a rich set of\nconfiguration options to help you pinpoint the data you want to inspect. For\nexample, you can turn on sampling to limit the data to be inspected to a certain\nnumber of rows (for BigQuery data) or certain file types (for\nCloud Storage data). You can also target a specific timespan in which\nthe data was created or modified.\n\nUnlike discovery, which continuously monitors your data, an inspection is an\non-demand operation. However, you can schedule recurring inspection jobs called\n*job triggers*.\n\n### Inspection scan output: findings\n\nEach finding includes details like the location of the detected instance, its\npotential infoType, and the certainty (also called\n[*likelihood*](/sensitive-data-protection/docs/likelihood)) that the finding matches the\ninfoType. Depending on your settings, you can also get the actual string that\nthe finding pertains to; this string is called a *quote* in\nSensitive Data Protection.\n\nFor a full list of details included in an inspection finding, see\n[`Finding`](/sensitive-data-protection/docs/reference/rpc/google.privacy.dlp.v2#finding).\n\n### When to use inspection\n\nAn inspection is useful when you need to investigate unstructured data (like\nuser-created comments or reviews) and identify each instance of personally\nidentifiable information (PII). If a discovery scan identifies any resources\ncontaining unstructured data, we recommend running an inspection scan on those\nresources to get details on each individual finding.\n\n### When not to use inspection\n\nInspecting a resource isn't useful if both of the following conditions apply.\nA discovery scan can help you decide if an inspection scan is needed.\n\n- You have only structured data in the resource. That is, there are no columns of freeform data, like user comments or reviews.\n- You already know the infoTypes stored in that resource.\n\nFor example, suppose that data profiles from a discovery scan indicate that a\ncertain BigQuery table doesn't have columns with unstructured\ndata but has a column of unique credit card numbers. In this case, inspecting\nfor credit card numbers in the table isn't useful. An inspection will produce a\nfinding for each item in the column. If you have 1 million rows and each row\ncontains 1 credit card number, an inspection job will produce 1 million findings\nfor the `CREDIT_CARD_NUMBER` infoType. In this example, the inspection isn't\nneeded because the discovery scan already indicates that the\ncolumn contains unique credit card numbers.\n\nData residency, processing, and storage\n---------------------------------------\n\nBoth discovery and inspection support data residency\nrequirements:\n\n- The discovery service processes your data where it resides and stores the generated data profiles in the same region or multi-region as the profiled data. For more information, see [Data residency\n considerations](/sensitive-data-protection/docs/data-profiles#data-residency).\n- When inspecting data within a Google Cloud storage system, the inspection service processes your data in the same region where the data resides and stores the inspection job in that region. When inspecting data through a hybrid job or through a [`content`](/sensitive-data-protection/docs/reference/rest/v2/projects.locations.content) method, the inspection service lets you specify where it should process your data. For more information, see [How data is\n stored](/sensitive-data-protection/docs/support/data-security#how-data-is-stored).\n\nComparison summary: discovery and inspection services\n-----------------------------------------------------\n\n^1^ Hybrid inspection has a different\npricing model. For more information, see [Inspection of data from any source](/sensitive-data-protection/pricing#hybrid-pricing).\n\nWhat's next\n-----------\n\n- Explore [recommended strategies for mitigating data\n risk](/sensitive-data-protection/docs/best-practices-for-mitigating-data-risk) (next document in this series)"]]
