This document contains current restrictions and usage limits when usingSensitive Data Protection. For billing information, see thepricing page.

These limits apply to each Google Cloud console project and are shared acrossall applications and IP addresses using that project.

You can set lower quotas in theGoogle Cloud console.

This table highlights important quotas for Sensitive Data Protection requestsin each project. For other quotas, see theQuotas & System Limits page inthe Google Cloud console.

Resource limits

Sensitive Data Protection enforces the following limits on stored resourcesper project.

Content inspection and de-identification limits

Sensitive Data Protection enforces the following usage limits forinspecting andde-identifying content sent directly to the DLP API as text or images:

If you need to inspect files that are larger than these limits, store thosefiles on Cloud Storage and run aninspection job.

Storage inspection limits

Sensitive Data Protection enforces the following usage limits forinspectingGoogle Cloud storage repositories:

Storage de-identification limits

Sensitive Data Protection enforces the following usage limit when youde-identify data in storage:

Data profiling limits

Sensitive Data Protection enforces the following usage limits forprofilingdata.

These limits apply globally for all data configurations at both organization andproject levels.

Subscription capacity used for profiling

This value depends on the number of subscription units that you purchased. Forexample, if you purchased 5 subscription units, you get 50,000 tokens for thewhole month. Therefore, you can consume around 1,667 tokens per day (that is,50,000 tokens divided by 30 days).

To review your subscription capacity usage, go to theSubscriptions page and clickReview capacity usage.

For information about how to calculate how many profiles can be generated byyour tokens, seeData resources profiled per subscriptionunit.

BigQuery profiling limits

Example: Organization-level limits

Suppose you have an organization that has two folders, and youcreate a scan configuration for each folder.The total number of tables to be profiled from both of the configurationsmust not exceed 200,000. The total number of columns in all thosetables must not exceed 20,000,000.

Example: Project-level limits

If you configure data profiling at the project level, then the total number oftables in that project must not exceed 200,000. The total number ofcolumns in all those tables must not exceed 20,000,000.

Cloud SQL profiling limits

Custom infoType limits

Sensitive Data Protection enforces the following limits forcustominfoTypes.

Stored infoType limits

Sensitive Data Protection enforces the following limits forcreating storedinfoTypes.

Avro scanning limits

Generally, Avro files have the same limitations for Sensitive Data Protection andBigQuery. If these limits are hit, binary scanning is used as afallback. The following limits apply to inspect content requests and inspectstorage jobs for Avro files:

Scanning limits for PDFs and Microsoft products

These limits apply when scanning the following types of files:

• PDF
• Microsoft Word
• Microsoft Excel
• Microsoft Powerpoint

If these limits are hit, binary scanning is used as a fallback.

These limits apply on these file types even if you set amaximum byte size perfile.

Quota increases

You can edit your quotas up to their maximum values on theQuotas & System Limits page for yourproject.To request an increase in quota, edit your quota with yourrequested increase and justification and submit your update. You arenotified when your request is received. You might be contacted for moreinformation regarding your request. After your request is reviewed, youare notified whether it has been approved or denied.

Quota dependencies

Depending on which features you are using, you may also need additional quota.

• Pub/Sub: If you are using Pub/Sub, you may need additionalquota.
• BigQuery:
  • Streaming API is used for persisting findings forinspect jobs, wherequota values and other restrictionsapply.
  • google.cloud.bigquery.storage.v1beta1.BigQueryStorage,which lists the contents of rows in a table, issubject to quotalimits.

Learn about service disruptions

Sensitive Data Protection has features that depend on otherGoogle Cloud services. Because of these dependencies, you can expectSensitive Data Protection to have comparable reliability as those products.

We make a best effort to retry until any recurring errors have subsided, butdegraded experiences may occur if those services experience disruptions.

Check theGoogle Cloud Status Dashboard forall known service disruptions. You can also subscribe to theGoogle Cloud Status Dashboard updatesJSON feed orRSS feed for push updates.