Stay organized with collections Save and categorize content based on your preferences.
This page describes best practices for using policy tags in BigQuery. Use policy tags to define access to your data when you use column-level access control or dynamic data masking.
To learn how to set policy tags on a column, see Set a policy tag on a column.
Build a hierarchy of data classesBuild a hierarchy of data classes that makes sense for your business.
First, consider what kinds of data the organization processes. Usually there are a small number of data classes managed by an organization. For example, an organization could have data classes such as:
A single data class can be applied to multiple data columns using a policy tag. You should leverage this level of abstraction to efficiently manage many columns with only a few policy tags.
Second, consider if there are groups of people who need different access to different data classes. For example, one group needs access to business- sensitive data such as revenues and customer history. Another group needs access to personally identifiable data (PII) like phone numbers and addresses.
Keep in mind that you can group policy tags together in a tree. Sometimes it is helpful to create a root policy tag that contains all of the other policy tags.
The following figure shows an example taxonomy. This hierarchy groups all data types into three top-level policy tags: High, Medium, and Low.
Each of the top-level policy tags contains leaf policy tags. For example, the High policy tag contains the Credit card, Government ID , and Biometric policy tags. The Medium and Low similarly have leaf policy tags.
This structure has several benefits:
You can grant access to an entire group of policy tags at once. For example, you can grant the Data Catalog Fine Grained Reader role on the Low tier.
You can move policy tags from one tier to another. For example, you can move Address from the Low tier to the Medium tier to further restrict its access, without needing to reclassify all Address columns.
Note: You can move a policy tag only through the Data CatalogPolicyTagManager.UpdatePolicyTag method.With this fine-grained access, you can manage access to many columns by controlling only a small number of data classification policy tags.
For more information about policy tags in BigQuery, see:
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-08-07 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-07 UTC."],[[["Policy tags in BigQuery are used to define access to data at the column level or when using dynamic data masking."],["Organizations should build a hierarchy of data classes relevant to their business, such as PII, financial data, or customer order history, to efficiently manage multiple columns with a few policy tags."],["Consider the various groups within your organization that require different levels of data access, such as those needing business-sensitive data versus those needing personally identifiable information (PII)."],["Policy tags can be grouped together in a tree structure, often with a root policy tag containing all others, allowing for simultaneous access grants and easy reclassification of data."],["Managing access with these policy tag hierarchies enables control over numerous columns by adjusting permissions on a small set of data classification policy tags."]]],[]]
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4