This page describes the data risk and sensitivity levels that Sensitive Data Protectionassigns todata profiles. Tounderstand the data risk levels, it's important to understand the sensitivitylevels first.

Note: When generating data profiles, Sensitive Data Protection scans for only the infoTypesthat you specify in yourinspection template. For example, suppose credit cardnumbers are present in a column. If theCREDIT_CARD_NUMBER infoType isn'tlisted in your inspection template, then the resulting sensitivity and data risklevels for that column don't reflect the presence of credit card numbers.

Sensitivity level

Sensitivity level is an indication of how sensitive the data in a project,table, or file store is. Data is sensitive if it contains detected elements,such as personally identifiable information (PII), financialdata, and credentials.

You can also set the sensitivity of each built-in or custom infoType that youscan for. The sensitivity of each detected infoType affects the resultingsensitivity rating of the profiled resource. For information about how tooverride the sensitivity of a built-in infoType or set the sensitivity of acustom infoType,seeManage infoTypes.

A data profile can have any of the following sensitivity levels:

High

Highly sensitive informationmight be present, including credit card numbers and certain national identifiers.

Moderate

Sensitive information that is not classified as highly sensitive might bepresent. Examples are email addresses and phone numbers, which can be consideredpersonally identifiable. The data might also include freeform text orunstructured data, such as comments.

Low

Sensitive information wasn't detected, and the data doesn't include freeformtext or unstructured data.

Unknown

The data couldn't be scanned successfully. It is uncertain if sensitive data exists.

Sensitivity signals

To calculate sensitivity, Sensitive Data Protection considers the following:

• Both the default sensitivity of each infoType found along with any useroverrides of the sensitivity.
• Thelikelihood thathighly sensitive infoTypesare present.
• Whether the data has an unstructured format and contains mostly freeformtext, like comments.

Data risk level

Data risk level is the risk associated with the data in its current state. Itconsiders the sensitivity level of the data in the resource and the presence ofaccess controls to protect that data.

High

High-sensitivity datamight be present, and there are no access controls to restrict dataexposure. Alternatively, moderate or high-sensitivity data is widely accessible.

Moderate

Moderate-sensitivity datamight be present, and there are no access controls to restrict dataexposure.

Low

The sensitivity level of the data is low. Alternatively, access to the datahas been further restricted, for example, through access controls.

A profiled data asset can also get aLow data risk level if youenabledautomatictaggingand opted to automatically set the data risk of the profiled data assets toLow.

Unknown

The data couldn't be scanned successfully. It is uncertain if sensitive data exists.

Data risk signals

To calculate data risk, Sensitive Data Protection considers the following:

• The calculated sensitivity level of the data.
• The presence of access controls that limit access to the data.
• Whether discovery is configured to set the data risk level toLow whenautomatic tagging is enabled. For more information, seeEnable the automatictagging in the discoveryconfiguration.This option automatically overrides any of the storage-specific formulas.

BigQuery data risk calculation

The following table shows howdata risk signals affectthe resulting data risk level that Sensitive Data Protection assigns to profiledBigQuery resources. TheData risk column shows the resulting datarisk level.

Data sensitivity	Is public	Column policy tag applied	Data risk
Low, moderate, or high	No	Yes	Low
Low, moderate, or high	Yes	Yes	Low
Low	No	No	Low
Moderate	No	No	Moderate
High	No	No	High

Cloud SQL data risk calculation

The following table shows howdata risk signals affectthe resulting data risk level that Sensitive Data Protection assigns to profiledCloud SQL resources. TheData risk column shows the resulting data risklevel.

Data sensitivity	Requires SSL	Public IP	Data risk
Low	Yes	Yes	Low
Low	Yes	No	Low
Low	No	Yes	Low
Low	No	No	Low
Moderate	Yes	Yes	Moderate
Moderate	Yes	No	Low
Moderate	No	Yes	High
Moderate	No	No	Moderate
High	Yes	Yes	High
High	Yes	No	Moderate
High	No	Yes	High
High	No	No	High

File store data risk calculation

The following table shows howdata risk signals affectthe resulting data risk level that Sensitive Data Protection assigns to profiledfile store resources. TheData risk column shows the resulting data risklevel.

Data sensitivity	Could contain public files	Data risk
Low	No	Low
Low	InconclusiveresourceVisibility	Low
Low	Yes	Low
Moderate	No	Low
Moderate	InconclusiveresourceVisibility	Moderate
Moderate	Yes	High
High	No	Moderate
High	InconclusiveresourceVisibility	High
High	Yes	High
Unknown	No	Unknown
Unknown	InconclusiveresourceVisibility	Unknown
Unknown	Yes	Unknown

What's next

• Learn aboutremediations you can take to reduce data risk and sensitivity.