Also known as: Cloud Data Loss Prevention (Cloud DLP).
At a glance
| Supported databases | BigQuery, BigLake, Cloud SQL, Datastore; any source through hybrid jobs |
| Auditing and activity monitoring | No; it classifies data, it does not monitor queries |
| Masking | Yes: masking and redaction through de-identification |
| Encryption or tokenization | Cryptographic tokenization, with re-identification |
| Privileged access | Not part of the service (use Cloud IAM) |
| Policy enforcement | Not a blocking control; findings feed Security Command Center |
| Compliance reporting | Data profiles and risk scores support privacy programmes |
| Deployment | Managed Google Cloud service |
| Licensing | Pay per GB, 1 GiB per month free for inspection and transformation; discovery US$0.03 per GB or US$2,500 per subscription unit |
Sensitive Data Protection is the default choice for finding and de-identifying personal data across BigQuery, Cloud SQL and Cloud Storage, and its DLP API can scan data from anywhere. Costs scale with bytes, so profile with sampling and estimates first; it does not monitor database activity, so pair it with audit logging for access evidence.
Overview
Sensitive Data Protection is a family of Google Cloud services for sensitive data. Discovery generates data profiles across an organisation, folder or project, showing which tables, buckets and datasets hold sensitive infoTypes and how risky they are. Inspection scans a specific resource for each instance of chosen infoTypes, through storage jobs or content methods. De-identification masks, redacts, buckets, date-shifts or tokenizes values, and risk analysis estimates the re-identification risk of structured BigQuery data.
All of this is exposed through the Cloud Data Loss Prevention API, the API of the former Cloud DLP product, which keeps its name. Discovery covers BigQuery, BigLake, Cloud SQL, Cloud Storage and Vertex AI data in Google Cloud, plus Amazon S3 and Azure Blob Storage; hybrid jobs inspect payloads from any source. High-risk findings can be published to Pub/Sub and Security Command Center.
Key features
- Organisation-wide discovery that profiles BigQuery, Cloud SQL, Cloud Storage and Vertex AI data, plus Amazon S3 and Azure Blob Storage
- Inspection with built-in and custom infoType detectors through storage jobs or synchronous content methods
- De-identification by masking, redaction, bucketing, date shifting and cryptographic tokenization
- Re-identification risk analysis (k-anonymity, l-diversity, k-map) for BigQuery tables
- Hybrid jobs that inspect data from sources outside Google Cloud
- Consumption or subscription pricing modes for discovery, with cost estimation for BigQuery data
- Findings sent to Security Command Center and Pub/Sub
Integrations and ecosystem
Pros and cons
Pros
- Fully published, per-GB pricing with free monthly allowances
- One API for discovery, inspection, de-identification and risk analysis
- Discovery reaches Amazon S3 and Azure Blob Storage as well as Google Cloud
- Subscription mode gives predictable discovery costs as data grows
Cons
- Costs grow with data volume; content inspection is US$3.00 per GiB after the free tier
- No database activity monitoring, firewall or access control
- Database coverage is centred on Google Cloud services (BigQuery, Cloud SQL, Datastore)
Pricing
Pay as you go in USD. Discovery (data profiling) has two modes: consumption at US$0.03 per GB profiled (billable size capped at 3 TB per table or bucket, with minimums such as US$0.01 per Cloud SQL table and US$0.03 per bucket; each BigLake table is billed as 300 GB), or subscription at US$2,500 per subscription unit, billed monthly after a one-month minimum term. A default organisation-level discovery subscription is included with a qualified Security Command Center subscription. Inspection and de-identification have a free first 1 GiB per month each: content methods cost US$3.00 per GiB inspected and US$2.00 per GiB transformed (US$2.00 and US$1.00 above 1 TiB), storage jobs US$1.00 per GiB inspected or transformed (US$0.75 above 50 TiB, US$0.60 above 500 TiB), and hybrid jobs US$3.00 per GiB (US$2.00 above 1 TiB). Cloud Storage and BigQuery charges caused by scans are extra.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Google Cloud data and privacy teams that need to find, classify and de-identify personal data in BigQuery, Cloud SQL and Cloud Storage.
Typical use cases
- Mapping where personal data sits across BigQuery and Cloud SQL for a GDPR record of processing
- Tokenizing identifiers before sharing BigQuery tables with analysts
- Redacting sensitive values from chat logs or support tickets through the DLP API
- Measuring re-identification risk before publishing a dataset
Who should look elsewhere
- Teams that need query-level activity monitoring or blocking: see DataSunrise or Imperva Data Security Fabric.
Verdict
Sensitive Data Protection is a capable, openly priced service for discovering and de-identifying sensitive data, strongest inside Google Cloud and able to reach S3 and Azure Blob Storage. Model per-GB costs before scanning large estates, and remember it classifies and transforms data rather than monitoring who accesses it.
Frequently asked questions
Is Sensitive Data Protection the same as Cloud DLP?
Yes. Google says Cloud Data Loss Prevention is now part of Sensitive Data Protection, and the API keeps the name Cloud Data Loss Prevention API (DLP API).
How is Sensitive Data Protection priced?
Discovery costs US$0.03 per GB profiled in consumption mode, or US$2,500 per subscription unit (billed monthly). Inspection and de-identification are per GiB, with the first 1 GiB per month free: content inspection is US$3.00 per GiB and storage job inspection US$1.00 per GiB at the first paid tier.
Can it scan databases outside Google Cloud?
Discovery covers Amazon S3 and Azure Blob Storage, and hybrid jobs or content methods can inspect data sent from any source, including on-premises databases, through the DLP API.
Is discovery included with Security Command Center?
A default organisation-level discovery subscription is included at no charge with a qualified Security Command Center subscription, according to the pricing page.
Sources
- Sensitive Data Protection pricing
- Sensitive Data Protection overview
- Data profiles (discovery) documentation
- Sensitive Data Protection documentation home
Checked November 2026.
Listed in: Database Security & Auditing.
How we research reviews and what star ratings mean: our editorial method.