Cloud Data Loss Prevention (Cloud DLP) 現已併入機密資料保護。API 名稱維持不變：Cloud Data Loss Prevention API (DLP API)。如要瞭解構成 Sensitive Data Protection 的服務，請參閱「Sensitive Data Protection 總覽」。
您可以使用 Cloud Data Loss Prevention API，以程式輔助方式使用 Sensitive Data Protection 服務。透過 DLP API，您可以檢查 Google Cloud 內外部資料，並在雲端內外建構自訂工作負載。詳情請參閱服務方法類型。
非同步作業
如要非同步檢查或分析靜態資料，可以使用 DLP API 建立 DlpJob。建立DlpJob等同於透過 Google Cloud 控制台建立檢查工作、混合工作或風險分析工作。DlpJob 的結果會儲存在 Google Cloud中。
同步作業
如要同步檢查、去識別化或重新識別資料，請使用 DLP API 的內嵌 content 方法。如要將圖片中的資料去識別化，可以使用 image.redact 方法。您可以在 API 要求中傳送資料，DLP API 會傳回檢查、去識別化或重新識別化結果。content 方法和 image.redact 方法的結果不會儲存在 Google Cloud中。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[],[],null,["# Sensitive Data Protection overview\n\nSensitive Data Protection helps you discover, classify, and de-identify\nsensitive data inside and outside Google Cloud. This page describes the services\nthat make up Sensitive Data Protection.\n\nSensitive data discovery\n------------------------\n\nThe discovery service lets you generate profiles for your data across\nan organization, folder, or project. Data profiles contain metrics and metadata\nabout your data assets and help you determine where [sensitive and high-risk\ndata](/sensitive-data-protection/docs/sensitivity-risk-calculation) reside. Sensitive Data Protection reports these metrics at various\nlevels of detail. For information about the types of data you can profile, see\n[Supported resources](/sensitive-data-protection/docs/data-profiles#supported-resources).\n\nYou use a *scan configuration* to specify the resource to scan, the\ntypes of information ([*infoTypes*](/sensitive-data-protection/docs/infotypes-reference)) to\nlook for, the profiling frequency, and the actions to take when profiling\nis complete.\n| **Tip:** Data profiling is useful if you want to scan large amounts of data at a high level. If you need to know the granular details, like the exact location of every instance of sensitive data, consider performing an [inspection](#inspection) as well.\n\nFor more information about the discovery service, see [Data\nprofiles overview](/sensitive-data-protection/docs/data-profiles).\n\nSensitive data inspection\n-------------------------\n\nThe inspection service lets you perform a deep scan of an individual\nresource to find instances of sensitive data. You specify the infoType that you\nwant to search for, and the inspection service generates a report about\nevery instance of data that matches that infoType. For example, the report tells\nyou how many credit card numbers are in a Cloud Storage bucket and the\nexact location of each instance.\n| **Tip:** An inspection is useful if you need\n| detailed information about each instance of sensitive data stored in a resource,\n| like a single\n| BigQuery table. It is especially useful if you have\n| unstructured data---like user-provided comments---that might have\n| intermittent instances of personally identifiable information.\n|\n| If you\n| need to perform automated scans of [multiple resources](/sensitive-data-protection/docs/data-profiles#supported-resources) across projects, folders,\n| or the entire organization, use the [discovery\n| service](#discovery) to generate data profiles.\n\nThere are two ways to perform an inspection:\n\n- Create an inspection or hybrid job through the Google Cloud console or through the Cloud Data Loss Prevention API of Sensitive Data Protection (DLP API).\n- Send a [`content.inspect`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API.\n\n### Inspection through a job\n\nYou can configure inspection and hybrid jobs through the Google Cloud console\nor through the Cloud Data Loss Prevention API. The results of inspection and hybrid jobs are\nstored in Google Cloud.\n\nYou can specify actions that you want Sensitive Data Protection to take\nwhen the inspection or hybrid job is complete. For example, you can configure a\njob to save the findings to a BigQuery table or send a\nPub/Sub notification.\n\n#### Inspection jobs\n\nSensitive Data Protection has built-in support for select\nGoogle Cloud products. You can inspect a BigQuery table, a\nCloud Storage bucket or folder, and a Datastore kind. For more\ninformation, see [Inspect Google Cloud storage and databases for sensitive\ndata](/sensitive-data-protection/docs/inspecting-storage).\n\n#### Hybrid jobs\n\nA hybrid job lets you scan payloads of data sent from any source, and\nthen store the inspection findings in Google Cloud. For more information,\nsee [Hybrid jobs and job triggers](/sensitive-data-protection/docs/concepts-hybrid-jobs).\n\n### Inspection through a `content.inspect` request\n\nThe `content.inspect` method of the DLP API lets you send data\ndirectly to the DLP API for inspection. The response contains the\ninspection findings. Use this approach if you require a synchronous operation or\nif you don't want to store the findings in Google Cloud.\n\nSensitive data de-identification\n--------------------------------\n\nThe de-identification service lets you obfuscate instances of sensitive data.\nVarious [transformation methods](/sensitive-data-protection/docs/transformations-reference)\nare available, including masking, redaction, bucketing, date shifting, and\ntokenization.\n\nThere are two ways to perform de-identification:\n\n- Create a de-identified copy of Cloud Storage data using an inspection job. For more information, see [De-identification of sensitive data in\n storage](/sensitive-data-protection/docs/concepts-deidentify-storage).\n- Send a [`content.deidentify`](/sensitive-data-protection/docs/reference/rest/v2/projects.content/inspect) request to the DLP API. For more information, see [De-identifying\n sensitive data](/sensitive-data-protection/docs/deidentify-sensitive-data).\n\nRisk analysis\n-------------\n\nThe risk analysis service lets you analyze structured\nBigQuery data to identify and visualize the risk that sensitive\ninformation will be revealed (*re-identified*).\n\nYou can use risk analysis methods before de-identification to help\ndetermine an effective de-identification strategy, or after de-identification to\nmonitor for any changes or outliers.\n\nYou perform risk analysis by creating a risk analysis job. For more information,\nsee [Re-identification risk analysis](/sensitive-data-protection/docs/concepts-risk-analysis).\n\nCloud Data Loss Prevention API\n------------------------------\n\nThe Cloud Data Loss Prevention API lets you use the Sensitive Data Protection services\nprogrammatically. Through the DLP API, you can inspect data from\ninside and outside Google Cloud and build custom workloads on or off\ncloud. For more information, see [Service method\ntypes](/sensitive-data-protection/docs/concepts-method-types).\n\n### Asynchronous operations\n\nIf you want to asynchronously inspect or analyze data at rest, you can use the\nDLP API to create a\n[`DlpJob`](/sensitive-data-protection/docs/reference/rest/v2/projects.dlpJobs). Creating a\n`DlpJob` is the equivalent of creating an inspection job, hybrid job, or risk\nanalysis job through the Google Cloud console. The results of a `DlpJob` are\nstored in Google Cloud.\n\n### Synchronous operations\n\nIf you want to inspect, de-identify, or re-identify data synchronously, use the\ninline `content` methods of the DLP API. To de-identify data in\nimages, you can use the\n[`image.redact`](/sensitive-data-protection/docs/reference/rest/v2/projects.image/redact)\nmethod. You send the data in an API request and the DLP API responds\nwith the inspection, de-identification, or re-identification results. The\nresults of `content` methods and the `image.redact` method aren't stored\nin Google Cloud.\n\nPricing\n-------\n\nFor information about costs associated with using Sensitive Data Protection,\nsee [Sensitive Data Protection pricing](/sensitive-data-protection/pricing).\n\nWhat's next\n-----------\n\n- Learn how to [profile data in a project](/sensitive-data-protection/docs/profile-project).\n- Learn how to [start or schedule an\n inspection](/sensitive-data-protection/docs/schedule-inspection-scan).\n- Learn how to [inspect data from external sources using hybrid jobs](/sensitive-data-protection/docs/how-to-hybrid-jobs).\n- Learn how to [create a de-identified copy of data stored in Cloud Storage](/sensitive-data-protection/docs/deidentify-storage-console).\n- Learn how to [compute k-anonymity for a dataset](/sensitive-data-protection/docs/compute-k-anonymity).\n- Learn how to [de-identify and re-identify data using the DLP API](/sensitive-data-protection/docs/inspect-sensitive-text-de-identify)."]]
