借助 Cloud Data Loss Prevention API，您可以以编程方式使用敏感数据保护服务。通过 DLP API，您可以检查云内外的数据， Google Cloud 并在云端或云端构建自定义工作负载。如需了解详情，请参阅服务方法类型。
异步操作
如果您想异步检查或分析静态数据，可以使用 DLP API 创建 DlpJob。创建 DlpJob 相当于通过 Google Cloud 控制台创建检查作业、混合作业或风险分析作业。DlpJob 的结果存储在 Google Cloud中。
同步操作
如果您想同步检查、去标识化或重标识数据，请使用 DLP API 的内嵌 content 方法。如需对图片中的数据进行去标识化处理，您可以使用 image.redact 方法。您在 API 请求中发送数据，DLP API 会响应以提供检查、去标识化或重新标识化结果。content 方法和 image.redact 方法的结果不会存储在 Google Cloud中。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[],[],null,["# Sensitive Data Protection overview\n\nSensitive Data Protection helps you discover, classify, and de-identify\nsensitive data inside and outside Google Cloud. This page describes the services\nthat make up Sensitive Data Protection.\n\nSensitive data discovery\n------------------------\n\nThe discovery service lets you generate profiles for your data across\nan organization, folder, or project. Data profiles contain metrics and metadata\nabout your data assets and help you determine where [sensitive and high-risk\ndata](/sensitive-data-protection/docs/sensitivity-risk-calculation) reside. Sensitive Data Protection reports these metrics at various\nlevels of detail. For information about the types of data you can profile, see\n[Supported resources](/sensitive-data-protection/docs/data-profiles#supported-resources).\n\nYou use a *scan configuration* to specify the resource to scan, the\ntypes of information ([*infoTypes*](/sensitive-data-protection/docs/infotypes-reference)) to\nlook for, the profiling frequency, and the actions to take when profiling\nis complete.\n| **Tip:** Data profiling is useful if you want to scan large amounts of data at a high level. If you need to know the granular details, like the exact location of every instance of sensitive data, consider performing an [inspection](#inspection) as well.\n\nFor more information about the discovery service, see [Data\nprofiles overview](/sensitive-data-protection/docs/data-profiles).\n\nSensitive data inspection\n-------------------------\n\nThe inspection service lets you perform a deep scan of an individual\nresource to find instances of sensitive data. You specify the infoType that you\nwant to search for, and the inspection service generates a report about\nevery instance of data that matches that infoType. For example, the report tells\nyou how many credit card numbers are in a Cloud Storage bucket and the\nexact location of each instance.\n| **Tip:** An inspection is useful if you need\n| detailed information about each instance of sensitive data stored in a resource,\n| like a single\n| BigQuery table. It is especially useful if you have\n| unstructured data---like user-provided comments---that might have\n| intermittent instances of personally identifiable information.\n|\n| If you\n| need to perform automated scans of [multiple resources](/sensitive-data-protection/docs/data-profiles#supported-resources) across projects, folders,\n| or the entire organization, use the [discovery\n| service](#discovery) to generate data profiles.\n\nThere are two ways to perform an inspection:\n\n- Create an inspection or hybrid job through the Google Cloud console or through the Cloud Data Loss Prevention API of Sensitive Data Protection (DLP API).\n- Send a [`content.inspect`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API.\n\n### Inspection through a job\n\nYou can configure inspection and hybrid jobs through the Google Cloud console\nor through the Cloud Data Loss Prevention API. The results of inspection and hybrid jobs are\nstored in Google Cloud.\n\nYou can specify actions that you want Sensitive Data Protection to take\nwhen the inspection or hybrid job is complete. For example, you can configure a\njob to save the findings to a BigQuery table or send a\nPub/Sub notification.\n\n#### Inspection jobs\n\nSensitive Data Protection has built-in support for select\nGoogle Cloud products. You can inspect a BigQuery table, a\nCloud Storage bucket or folder, and a Datastore kind. For more\ninformation, see [Inspect Google Cloud storage and databases for sensitive\ndata](/sensitive-data-protection/docs/inspecting-storage).\n\n#### Hybrid jobs\n\nA hybrid job lets you scan payloads of data sent from any source, and\nthen store the inspection findings in Google Cloud. For more information,\nsee [Hybrid jobs and job triggers](/sensitive-data-protection/docs/concepts-hybrid-jobs).\n\n### Inspection through a `content.inspect` request\n\nThe `content.inspect` method of the DLP API lets you send data\ndirectly to the DLP API for inspection. The response contains the\ninspection findings. Use this approach if you require a synchronous operation or\nif you don't want to store the findings in Google Cloud.\n\nSensitive data de-identification\n--------------------------------\n\nThe de-identification service lets you obfuscate instances of sensitive data.\nVarious [transformation methods](/sensitive-data-protection/docs/transformations-reference)\nare available, including masking, redaction, bucketing, date shifting, and\ntokenization.\n\nThere are two ways to perform de-identification:\n\n- Create a de-identified copy of Cloud Storage data using an inspection job. For more information, see [De-identification of sensitive data in\n storage](/sensitive-data-protection/docs/concepts-deidentify-storage).\n- Send a [`content.deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API. For more information, see [De-identifying\n sensitive data](/sensitive-data-protection/docs/deidentify-sensitive-data).\n\nRisk analysis\n-------------\n\nThe risk analysis service lets you analyze structured\nBigQuery data to identify and visualize the risk that sensitive\ninformation will be revealed (*re-identified*).\n\nYou can use risk analysis methods before de-identification to help\ndetermine an effective de-identification strategy, or after de-identification to\nmonitor for any changes or outliers.\n\nYou perform risk analysis by creating a risk analysis job. For more information,\nsee [Re-identification risk analysis](/sensitive-data-protection/docs/concepts-risk-analysis).\n\nCloud Data Loss Prevention API\n------------------------------\n\nThe Cloud Data Loss Prevention API lets you use the Sensitive Data Protection services\nprogrammatically. Through the DLP API, you can inspect data from\ninside and outside Google Cloud and build custom workloads on or off\ncloud. For more information, see [Service method\ntypes](/sensitive-data-protection/docs/concepts-method-types).\n\n### Asynchronous operations\n\nIf you want to asynchronously inspect or analyze data at rest, you can use the\nDLP API to create a\n[`DlpJob`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs). Creating a\n`DlpJob` is the equivalent of creating an inspection job, hybrid job, or risk\nanalysis job through the Google Cloud console. The results of a `DlpJob` are\nstored in Google Cloud.\n\n### Synchronous operations\n\nIf you want to inspect, de-identify, or re-identify data synchronously, use the\ninline `content` methods of the DLP API. To de-identify data in\nimages, you can use the\n[`image.redact`](/sensitive-data-protection/docs/reference/rest/v2/projects.image/redact)\nmethod. You send the data in an API request and the DLP API responds\nwith the inspection, de-identification, or re-identification results. The\nresults of `content` methods and the `image.redact` method aren't stored\nin Google Cloud.\n\nPricing\n-------\n\nFor information about costs associated with using Sensitive Data Protection,\nsee [Sensitive Data Protection pricing](/sensitive-data-protection/pricing).\n\nWhat's next\n-----------\n\n- Learn how to [profile data in a project](/sensitive-data-protection/docs/profile-project).\n- Learn how to [start or schedule an\n inspection](/sensitive-data-protection/docs/schedule-inspection-scan).\n- Learn how to [inspect data from external sources using hybrid jobs](/sensitive-data-protection/docs/how-to-hybrid-jobs).\n- Learn how to [create a de-identified copy of data stored in Cloud Storage](/sensitive-data-protection/docs/deidentify-storage-console).\n- Learn how to [compute k-anonymity for a dataset](/sensitive-data-protection/docs/compute-k-anonymity).\n- Learn how to [de-identify and re-identify data using the DLP API](/sensitive-data-protection/docs/inspect-sensitive-text-de-identify)."]]
