Sensitive Data Protection (formerly Cloud DLP) Complete Guide: PII Detection & Masking on GCP

Sensitive Data Protection (formerly Cloud DLP) is GCP's service for detecting and masking PII (Personally Identifiable Information). With 200+ built-in infoTypes and the Discovery feature, it automatically surfaces sensitive data in large-scale datasets. Rebranded in 2024, it has evolved into a unified platform combining Discovery and De-identification.

Key Features

• Inspection: Detect PII in text, images, and structured data
• Discovery: Automatic PII cataloging across BigQuery, Cloud SQL, and GCS
• De-identification: Masking, Tokenization, and FPE
• Risk Analysis: k-anonymity and l-diversity evaluation
• Custom InfoTypes: Custom detection using regex or dictionary lists
• Pub/Sub Integration: Real-time masking

Sample InfoTypes

Discovery: Auto PII Scanning on BigQuery

# Discovery Scan Config 作成
gcloud dlp discovery-configs create \
  --location=global \
  --project=my-project \
  --discovery-config-from-file=config.yaml

# config.yaml
displayName: "BQ PII Discovery"
status: RUNNING
targets:
  - bigQueryTarget:
      filter:
        otherTables: {}
      cadence:
        updateFrequency: UPDATE_FREQUENCY_DAILY
inspectTemplates:
  - "projects/my-project/inspectTemplates/pii-template"

Inspection Example (Python)

from google.cloud import dlp_v2

client = dlp_v2.DlpServiceClient()
parent = f"projects/my-project/locations/global"

inspect_config = {
    "info_types": [
        {"name": "EMAIL_ADDRESS"},
        {"name": "PHONE_NUMBER"},
        {"name": "JAPAN_INDIVIDUAL_NUMBER"},
    ],
    "min_likelihood": dlp_v2.Likelihood.POSSIBLE,
    "include_quote": True,
}

item = {"value": "山田太郎、メール: [email protected]、電話: 03-1234-5678、マイナンバー: 123456789012"}
response = client.inspect_content(
    request={"parent": parent, "inspect_config": inspect_config, "item": item}
)

for finding in response.result.findings:
    print(f"{finding.info_type.name}: {finding.quote} ({finding.likelihood.name})")
# 出力:
# EMAIL_ADDRESS: [email protected] (LIKELY)
# PHONE_NUMBER: 03-1234-5678 (LIKELY)
# JAPAN_INDIVIDUAL_NUMBER: 123456789012 (VERY_LIKELY)

De-identification Methods

Pub/Sub Real-time Anonymization Pipeline

# Cloud Function でメッセージ受信時にマスキング
def deidentify_message(event, context):
    from google.cloud import dlp_v2
    import base64, json

    message = base64.b64decode(event['data']).decode('utf-8')
    data = json.loads(message)

    client = dlp_v2.DlpServiceClient()
    response = client.deidentify_content(
        request={
            "parent": "projects/my-project/locations/global",
            "deidentify_config": {
                "info_type_transformations": {
                    "transformations": [{
                        "primitive_transformation": {
                            "character_mask_config": {
                                "masking_character": "*",
                                "number_to_mask": 0,
                            }
                        }
                    }]
                }
            },
            "inspect_config": {
                "info_types": [{"name": "EMAIL_ADDRESS"}, {"name": "PHONE_NUMBER"}],
            },
            "item": {"value": data.get('text', '')},
        }
    )
    # マスク済みデータを別 Topic に転送
    publish_to_clean_topic(response.item.value)

Pricing Examples

Typical Use Cases

• Finance: Automatic masking of customer PII (for Looker and analytics)
• Healthcare: De-identification of medical records (for research)
• Customer support: PII masking on call recordings
• SaaS: Monitoring tenant data leakage risk
• GDPR: Periodic scans of EU personal data
• Security audits: PII cataloging across all BigQuery tables

* Google Cloud is a trademark of Google LLC. For the latest information, see the official Sensitive Data Protection documentation.