Masking sensitive fields and controlling who can see them

Google Cloud lets you protect sensitive analytics data through layered IAM permissions, BigQuery's built-in column/row-level security, and Sensitive Data Protection (formerly Cloud DLP) for discovering and de-identifying PII before or during analysis. Exam questions typically test which control (IAM role, policy tag, authorized view, or DLP transformation) fits a given masking or access scenario. Understand that IAM controls *who* can access a resource, while column/row-level security and DLP control *what data* they see once granted access.

1 · Learn the must-know

• 1IAM at the project/dataset/table level (e.g., BigQuery dataViewer, dataEditor, dataOwner) controls coarse-grained access; use the principle of least privilege and prefer predefined roles over primitive roles.
• 2BigQuery column-level security uses Data Catalog policy tags plus IAM (Data Catalog fine-grained reader role) to restrict which columns a user can query, independent of table-level access.
• 3Row-level security in BigQuery is implemented via CREATE ROW ACCESS POLICY, filtering rows returned based on the querying user's identity or group.
• 4Authorized views and authorized datasets let you share query results without granting underlying table access, useful for masking logic implemented in SQL.
• 5Sensitive Data Protection (Cloud DLP) can inspect data (structured or unstructured) to detect infoTypes like emails or credit card numbers, and de-identify it using techniques such as masking, tokenization, format-preserving encryption, or date shifting via inspect/de-identify templates and jobs.
• 6Cloud DLP de-identification is typically applied in a pipeline (e.g., Dataflow) before loading into BigQuery, whereas column/row-level security and IAM control access after the data is already stored, know which layer a scenario is asking about.

2 · Check your understanding