Securing Sensitive Data with Object-Level Security Classes and Column-Level PII Tags
Introduction
As organizations scale their data platforms, controlling **who can access what data—and at what level of detail—**becomes critical.
Traditional access control mechanisms are often too coarse-grained, granting full access to datasets without considering the sensitivity of individual fields such as PII (Personally Identifiable Information).
At Datilis, we address this challenge with a Data Masking & Access Control Framework that combines:
- Object-level security classification (tables, buckets, folders)
- Column-level PII tagging and masking
This approach enables fine-grained, policy-driven access control, ensuring that sensitive data is protected while still enabling business users to work effectively.
The Problem: Limited and Inconsistent Data Access Control
Organizations commonly face:
- Overexposure of sensitive data due to broad access roles
- Lack of consistent classification of data assets
- No differentiation between access to datasets vs. sensitive columns
- Manual processes for granting and revoking access
- Difficulty meeting compliance requirements (GDPR, internal policies)
The result:
- Increased security risk
- Compliance challenges
- Reduced trust in the data platform
The Datilis Approach: Two-Layer Security Model
We implement a two-layer access control model:
🔹 1. Object-Level Security Classes
Security classes are applied at the object level:
- Tables
- Storage buckets
- Folders
Each object is assigned a security classification, such as:
- Public
- Internal
- Confidential
- Restricted
Access is granted through:
- IAM roles
- Group-based permissions
- Role-based access control (RBAC)
Purpose:
- Control access to datasets as a whole
- Define baseline security boundaries
🔹 2. Column-Level PII Tags & Masking
Sensitive data is further protected at the column level:
- Columns are tagged with PII classifications
- Policy tags define masking rules
Examples:
- Email → masked or hashed
- Phone number → partially masked
- ID numbers → fully hidden
Based on user roles:
- Some users see full data
- Others see masked values
- Some see no data at all
Purpose:
- Protect sensitive attributes
- Enable safe data sharing
Architecture Overview
The framework operates through a policy-driven workflow:
Step 1: Define Taxonomy
- Create classification hierarchy
- Define PII categories
Step 2: Define Policies
- Create masking rules (nullify, hash, partial mask)
- Assign policies to tags
Step 3: Apply Tags
- Assign security classes to objects
- Tag sensitive columns
Step 4: Control Access
- Grant access via roles (e.g., Masked Reader)
- Enforce policies dynamically at query time
How It Works in Practice
When a user queries data:
- System checks object-level access
- System evaluates column-level policies
- Data is returned based on permissions:
| User Role | Access Result |
|---|---|
| Full Access | Clear text |
| Masked Reader | Masked values |
| Restricted | No access |
Integration with Data Platform
The framework integrates seamlessly with:
- Data warehouses (BigQuery, Hive)
- Metadata and governance layers
- Identity & access management systems
It works alongside:
- Data Contracts → define sensitivity
- Data Quality → validate data integrity
- Data Retention → manage lifecycle
Key Capabilities
Fine-Grained Access Control
- Object-level + column-level enforcement
Dynamic Data Masking
- Real-time masking based on user roles
Policy-Driven Governance
- Centralized definition of security rules
PII Protection
- Secure handling of sensitive data
Audit & Compliance
- Track access and policy enforcement
Business Benefits
Organizations adopting this framework achieve:
- Reduced risk of data exposure
- Strong GDPR and compliance alignment
- Secure data sharing across teams
- Increased trust in the data platform
- Scalable and manageable access control
Strategic Value
This framework enables: Secure-by-design data platforms
It ensures that:
- Sensitive data is always protected
- Access is controlled and auditable
- Governance is embedded into the platform
Why Datilis
Datilis combines:
- Deep expertise in data platform security and governance
- Proven frameworks for data quality, retention, and contracts
- Strong integration with modern cloud data platforms
- Focus on automation and policy-driven architecture
We don’t just secure data—we build governed and trusted data ecosystems.
Conclusion
In modern data platforms, security must be:
- Granular
- Automated
- Embedded into the architecture
By combining object-level security classes with column-level PII masking, Datilis enables organizations to:
- Protect sensitive data
- Enable controlled access
- Ensure compliance at scale
Next Steps
1. Assess Data Sensitivity
- Identify PII and critical datasets
2. Define Security Taxonomy
- Establish classification levels
3. Implement Policy Tags
- Apply column-level tagging
4. Integrate Access Control
- Align with IAM and roles
5. Launch a Pilot
- Start with one domain or dataset
Contact Datilis to implement secure, policy-driven data access control