BigQuery’s New Data Governance Tags: Column Security Evolved

BigQuery’s policy tags were the go-to for column-level security, but as data ecosystems grow, so must our tools. Enter data governance tags—a new, scalable way to manage access controls on your sensitive columns. Built on Google Cloud’s IAM Resource Manager, these tags are now in preview, and they’re a game-changer for developers swimming in complex data swamps.

What Are Data Governance Tags?

Think of them as supercharged labels for your columns. Unlike the old regional policy tags, these are global, hierarchical, and built for disaster recovery. You create a tag key with --purpose=DATA_GOVERNANCE, then attach values to columns. The result? A flexible, decoupled governance system that lets you classify before you enforce.

Why Upgrade?

• Global scope, regional enforcement: Define a tag once, use it across any project or region.
• Managed disaster recovery: Tags and policies replicate automatically to secondary regions.
• Hierarchical security: Build a tree up to five levels deep (e.g., PII > Financial > CreditCardNumber).
• Decoupled governance: Tag data first, enforce access later—flexibility for onboarding.

Three Steps to Column-Level Security

Step 1: Create the Tag Key and Values

Use gcloud to create a tag key with --purpose=DATA_GOVERNANCE, then add values in a hierarchy.

gcloud resource-manager tags keys create data_class --parent=projects/my-governance-project --purpose=DATA_GOVERNANCE
gcloud resource-manager tags values create pii --parent=my-governance-project/data_class
gcloud resource-manager tags values create private --parent=my-governance-project/data_class/pii

Step 2: Attach Tags to Columns

Update your table schema via JSON or SQL. Add dataGovernanceTags to sensitive columns.

bq show --schema --format=prettyjson my_project:my_dataset.my_table > schema.json
# Edit schema.json to add tags
bq update --project_id=my-data-project --schema=schema.json my_dataset.my_table

Or use SQL:

ALTER TABLE my_dataset.my_table
ALTER COLUMN phone_number
SET OPTIONS (data_governance_tags = [('my-governance-project/data_class', 'private')]);

Step 3: Create Data Policies

Define masking or raw access policies in the same region as your table. Policies reference the tag values.

curl --request POST "https://bigquerydatapolicy.googleapis.com/v2/projects/myProject/locations/us-east1/dataPolicies" ... --data '{"dataPolicy": {"dataPolicyType": "DATA_MASKING_POLICY", "dataMaskingPolicy": {"predefinedExpression": "SHA256"}, "grantees": ["principalSet://goog/group/[email protected]"], "dataGovernanceTag": {"key": "myProject/data_class", "value": "pii"}}, "dataPolicyId": "masking_policy_for_data_class_pii"}'

Get Started Today

Data governance tags are in preview. They integrate with Google Cloud and work alongside tools like Supabase and Neon for a robust data stack. Future updates will bring SQL-based tag creation, multi-tag support, and deeper integrations. Dive into the documentation and start tagging!

Original announcement published on Google Cloud.