Professional Data EngineerManaging and securing dataMedium
A global retail company uses BigQuery for its analytics platform. They have a dataset containing customer personally identifiable information (PII) that must be protected according to GDPR. Data analysts need to query this data for aggregate reports, but must never see the raw PII. The security team wants a solution that allows different levels of access to specific columns based on user roles, without creating multiple copies of the data. Which BigQuery feature should the data engineering team implement?
- ABigQuery data partitioning
- BBigQuery authorized views
- CBigQuery row-level security
- DBigQuery column-level security
Show answer & explanationAnswer & explanation
Correct answer: D. BigQuery column-level security
BigQuery column-level security allows fine-grained access control to specific columns within a table. This enables different user roles to have varying levels of access to sensitive PII columns, satisfying the requirement for aggregate reports without exposing raw data.
Why the other options are wrong
- A. Data partitioning optimizes query performance and cost, not data access control for sensitive columns.
- B. Authorized views can restrict access to subsets of data, but column-level security directly applies policies at the column level.
- C. Row-level security restricts access to specific rows, not columns.
BigQuery Column-level Security
BigQuery column-level security allows you to define granular access policies on specific columns within a table, ensuring that only authorized users or groups can view or query sensitive data.
- Uses IAM policies on policy tags.
- Integrates with Data Catalog policy tags.
- Prevents unauthorized access to sensitive columns.
Memory trick: BigQuery Guards Data Carefully, Controlling Access.