Sensitive Data Protection は、 Google Cloudの内部と外部の機密データを検出、分類、匿名化するのに役立ちます。このページでは、機密データの保護を構成するサービスについて説明します。
機密データの検出
検出サービスを使用すると、組織、フォルダ、プロジェクト全体のデータのプロファイルを生成できます。データ プロファイルには、データアセットに関する指標とメタデータが含まれており、機密データとリスクの高いデータの場所を特定できます。Sensitive Data Protection は、これらの指標をさまざまな詳細レベルで報告します。プロファイリングできるデータの種類については、サポートされているリソースをご覧ください。
Cloud Data Loss Prevention API では、機密データの保護サービスをプログラムで使用できます。DLP API を使用すると、内部および外部のデータを確認して、クラウドの内部または外部にカスタム ワークロードを構築できます。 Google Cloud 詳細については、サービス メソッドのタイプをご覧ください。
非同期オペレーション
非同期で保存データの検査または分析を行う場合は、DLP API を使用して DlpJob を作成できます。DlpJob の作成は、 Google Cloud コンソールから検査ジョブ、ハイブリッド ジョブ、リスク分析ジョブを作成する操作と同等です。DlpJob の結果は Google Cloudに保存されます。
同期オペレーション
データを同期的に検査、匿名化、再識別する場合は、DLP API の content インライン メソッドを使用します。画像内のデータの匿名化を行うには、image.redact メソッドを使用します。API リクエストでデータを送信すると、DLP API から検査、匿名化、再識別の結果が返されます。content メソッドと image.redact メソッドの結果は Google Cloudに保存されません。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-19 UTC。"],[],[],null,["# Sensitive Data Protection overview\n\nSensitive Data Protection helps you discover, classify, and de-identify\nsensitive data inside and outside Google Cloud. This page describes the services\nthat make up Sensitive Data Protection.\n\nSensitive data discovery\n------------------------\n\nThe discovery service lets you generate profiles for your data across\nan organization, folder, or project. Data profiles contain metrics and metadata\nabout your data assets and help you determine where [sensitive and high-risk\ndata](/sensitive-data-protection/docs/sensitivity-risk-calculation) reside. Sensitive Data Protection reports these metrics at various\nlevels of detail. For information about the types of data you can profile, see\n[Supported resources](/sensitive-data-protection/docs/data-profiles#supported-resources).\n\nYou use a *scan configuration* to specify the resource to scan, the\ntypes of information ([*infoTypes*](/sensitive-data-protection/docs/infotypes-reference)) to\nlook for, the profiling frequency, and the actions to take when profiling\nis complete.\n| **Tip:** Data profiling is useful if you want to scan large amounts of data at a high level. If you need to know the granular details, like the exact location of every instance of sensitive data, consider performing an [inspection](#inspection) as well.\n\nFor more information about the discovery service, see [Data\nprofiles overview](/sensitive-data-protection/docs/data-profiles).\n\nSensitive data inspection\n-------------------------\n\nThe inspection service lets you perform a deep scan of an individual\nresource to find instances of sensitive data. You specify the infoType that you\nwant to search for, and the inspection service generates a report about\nevery instance of data that matches that infoType. For example, the report tells\nyou how many credit card numbers are in a Cloud Storage bucket and the\nexact location of each instance.\n| **Tip:** An inspection is useful if you need\n| detailed information about each instance of sensitive data stored in a resource,\n| like a single\n| BigQuery table. It is especially useful if you have\n| unstructured data---like user-provided comments---that might have\n| intermittent instances of personally identifiable information.\n|\n| If you\n| need to perform automated scans of [multiple resources](/sensitive-data-protection/docs/data-profiles#supported-resources) across projects, folders,\n| or the entire organization, use the [discovery\n| service](#discovery) to generate data profiles.\n\nThere are two ways to perform an inspection:\n\n- Create an inspection or hybrid job through the Google Cloud console or through the Cloud Data Loss Prevention API of Sensitive Data Protection (DLP API).\n- Send a [`content.inspect`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API.\n\n### Inspection through a job\n\nYou can configure inspection and hybrid jobs through the Google Cloud console\nor through the Cloud Data Loss Prevention API. The results of inspection and hybrid jobs are\nstored in Google Cloud.\n\nYou can specify actions that you want Sensitive Data Protection to take\nwhen the inspection or hybrid job is complete. For example, you can configure a\njob to save the findings to a BigQuery table or send a\nPub/Sub notification.\n\n#### Inspection jobs\n\nSensitive Data Protection has built-in support for select\nGoogle Cloud products. You can inspect a BigQuery table, a\nCloud Storage bucket or folder, and a Datastore kind. For more\ninformation, see [Inspect Google Cloud storage and databases for sensitive\ndata](/sensitive-data-protection/docs/inspecting-storage).\n\n#### Hybrid jobs\n\nA hybrid job lets you scan payloads of data sent from any source, and\nthen store the inspection findings in Google Cloud. For more information,\nsee [Hybrid jobs and job triggers](/sensitive-data-protection/docs/concepts-hybrid-jobs).\n\n### Inspection through a `content.inspect` request\n\nThe `content.inspect` method of the DLP API lets you send data\ndirectly to the DLP API for inspection. The response contains the\ninspection findings. Use this approach if you require a synchronous operation or\nif you don't want to store the findings in Google Cloud.\n\nSensitive data de-identification\n--------------------------------\n\nThe de-identification service lets you obfuscate instances of sensitive data.\nVarious [transformation methods](/sensitive-data-protection/docs/transformations-reference)\nare available, including masking, redaction, bucketing, date shifting, and\ntokenization.\n\nThere are two ways to perform de-identification:\n\n- Create a de-identified copy of Cloud Storage data using an inspection job. For more information, see [De-identification of sensitive data in\n storage](/sensitive-data-protection/docs/concepts-deidentify-storage).\n- Send a [`content.deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API. For more information, see [De-identifying\n sensitive data](/sensitive-data-protection/docs/deidentify-sensitive-data).\n\nRisk analysis\n-------------\n\nThe risk analysis service lets you analyze structured\nBigQuery data to identify and visualize the risk that sensitive\ninformation will be revealed (*re-identified*).\n\nYou can use risk analysis methods before de-identification to help\ndetermine an effective de-identification strategy, or after de-identification to\nmonitor for any changes or outliers.\n\nYou perform risk analysis by creating a risk analysis job. For more information,\nsee [Re-identification risk analysis](/sensitive-data-protection/docs/concepts-risk-analysis).\n\nCloud Data Loss Prevention API\n------------------------------\n\nThe Cloud Data Loss Prevention API lets you use the Sensitive Data Protection services\nprogrammatically. Through the DLP API, you can inspect data from\ninside and outside Google Cloud and build custom workloads on or off\ncloud. For more information, see [Service method\ntypes](/sensitive-data-protection/docs/concepts-method-types).\n\n### Asynchronous operations\n\nIf you want to asynchronously inspect or analyze data at rest, you can use the\nDLP API to create a\n[`DlpJob`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs). Creating a\n`DlpJob` is the equivalent of creating an inspection job, hybrid job, or risk\nanalysis job through the Google Cloud console. The results of a `DlpJob` are\nstored in Google Cloud.\n\n### Synchronous operations\n\nIf you want to inspect, de-identify, or re-identify data synchronously, use the\ninline `content` methods of the DLP API. To de-identify data in\nimages, you can use the\n[`image.redact`](/sensitive-data-protection/docs/reference/rest/v2/projects.image/redact)\nmethod. You send the data in an API request and the DLP API responds\nwith the inspection, de-identification, or re-identification results. The\nresults of `content` methods and the `image.redact` method aren't stored\nin Google Cloud.\n\nPricing\n-------\n\nFor information about costs associated with using Sensitive Data Protection,\nsee [Sensitive Data Protection pricing](/sensitive-data-protection/pricing).\n\nWhat's next\n-----------\n\n- Learn how to [profile data in a project](/sensitive-data-protection/docs/profile-project).\n- Learn how to [start or schedule an\n inspection](/sensitive-data-protection/docs/schedule-inspection-scan).\n- Learn how to [inspect data from external sources using hybrid jobs](/sensitive-data-protection/docs/how-to-hybrid-jobs).\n- Learn how to [create a de-identified copy of data stored in Cloud Storage](/sensitive-data-protection/docs/deidentify-storage-console).\n- Learn how to [compute k-anonymity for a dataset](/sensitive-data-protection/docs/compute-k-anonymity).\n- Learn how to [de-identify and re-identify data using the DLP API](/sensitive-data-protection/docs/inspect-sensitive-text-de-identify)."]]
