Data Privacy at Databricks

Summary

The ideal privacy program is invisible to data users — automatically enforcing GDPR, CCPA, and other regulations without requiring engineers to become legal experts, while ensuring data remains useful for innovation.
As AI agents now access data at machine speed across hundreds of SaaS instances, Databricks is deploying Unity Catalog features including dynamic data masking and attribute-based access control to govern agent access at scale.
This video explains how Databricks' legal and security teams use fine-grained access controls, consent enforcement, and GDPR audit trails to maintain data utility for engineers without compromising privacy.

Data Privacy at Databricks

Handling PII and sensitive data is a top priority, especially for the platform storing the world’s data. this video details the privacy architecture used by the Databricks legal and security teams. We will show how we use Unity Catalog’s fine-grained access controls, dynamic masking and attribute-based access control (ABAC) to enforce GDPR and CCPA compliance internally. See how we ensure data utility for our engineers without ever compromising on privacy.
Talk By: Bruce Wong, Sr. Director, Data Platform, Databricks ; Li Yang, Senior Engineering Manager, Databricks ;

Chapters

FAQs

How does Databricks enforce data privacy for AI agents?

Databricks uses Unity Catalog's dynamic data masking and attribute-based access control (ABAC) to enforce privacy policies automatically as agents access data, without requiring agents to read policy documents. This ensures that sensitive columns are masked or filtered based on the agent's purpose and credentials, preventing unauthorized data exposure at machine speed.

What is attribute-based access control (ABAC) in Unity Catalog?

ABAC in Unity Catalog allows access policies to be expressed in terms of contextual attributes — such as a user's role, geographic location, or the data's sensitivity classification — rather than simple allow/deny lists. This richer context enables more precise enforcement of regulations like GDPR purpose limitation and data residency requirements.

How does Databricks handle GDPR consent and audit trails for agents?

Databricks has implemented consent enforcement mechanisms in Unity Catalog so that agent data access is gated by recorded consent records, providing GDPR-compliant audit trails for every interaction. This means each agent access is logged with enough context to prove compliance during regulatory review.

Why is data privacy described as a context problem rather than a policy problem?

Privacy policies only work when the platform has contextual information about who is accessing data, for what purpose, and from where — without this context, even well-written policies cannot be enforced automatically. This video argues that embedding context directly into the platform via Unity Catalog is the only scalable approach in the agentic AI era.

Full transcript

[00:08] No matter what company, data privacy applies to all of our companies and all of our use cases. So, I've led data privacy programs at every place that I've had a data platform. And one of the things I always
[00:20] talk about is the ideal privacy program is the one that is invisible. Now, what do I mean by that? You can't go
[00:32] train every single person who wants to use data about GDPR or about data privacy or about all the uh the the laws about data protection and stuff like
[00:44] it's just not feasible in any of our organizations not most of us are not lawyers uh to understand that and so the ideal privacy program actually is invisible to us and but we need to make
[00:57] sure that we're uh doing things correctly you know when data gets exposed and you end up in the Wall Street Journal, that's definitely visible as well. And so the ideal place
[01:09] is that data privacy uh data privacy is actually invisible. But there in lies a tension. There's a tension between well if we just don't if we just don't have any data, then there's like no problem.
[01:22] There's nothing to to worry about if you have no data. But then if you have any data then like there's a tension on like well how do how do we make sure that we're privacy aware and so forth. Um and
[01:34] data is so powerful. I think that's one of the things that's that I'm most excited about Agentic AI, even with my example of agents looking at the wrong data, is that agents are now able to
[01:48] look at process enormous amounts of data on our behalf in ways that we could never dream of before. But that also means that we're sort of entering a new realm of what data privacy actually
[02:00] means and looks like um in the realm of aic AI. So, you know, let's talk about agents and AI, you know, and I think for us internally, we've gone through a pretty
[02:12] interesting journey. Um, six months ago, I would say I personally probably had maybe somewhere between one and five agents running on data at any
[02:24] given point in time. That was six months ago. And as the models have gotten better, as I've gotten better at using AI, like now I literally do have hundreds of agents running at any given
[02:37] point in time doing research on my behalf now. Okay. And so agents are outpacing our employees. Like the growth of agents is actually outpacing us. And
[02:49] so we, you know, we were analyzing at data bricks like what the what does the data access actually look like? uh and about three months ago so six months ago we were kind of learning and the models
[03:01] were getting better and it literally took from there to three months ago where we crossed a boundary where there was more agentic access of data than there was human access of data. Okay. Um
[03:15] and so and the thing is it's not going the that delta is growing not coming back right and so you can see the the the graph is growing the problem is getting way way harder agents are moving
[03:28] faster and faster you know the the hypothetical skit was not actually hypothetical we've actually had some interesting uh interesting times at data bicks figuring out like oh that was your agent that wasn't actually
[03:41] you right and now there's is like 100x more, right? And we're not hiring a 100x more engineers to handle this. And so that that presented us a problem
[03:54] of like, how are we going to do data privacy? How do we train all of these agents about data privacy? And so we had this novel thought. We're like, well,
[04:06] what if they were on our side? What if we had agents that were on our side? What if we could teach them about data privacy? Uh what if the agents could actually read all of GDPR and any any
[04:20] applicable privacy um regime uh and actually have much better knowledge than even us as individuals have. And so this is our story. Instead of everyone's
[04:32] agent interacting with our systems directly, we asked what if your agent talked to my agent and my agent knows about data privacy. And so I'm super happy to ex to welcome up Lee. I've
[04:46] worked with Lee uh for a very long time. We both worked at Netflix a very very long time ago. We were uh both of us were in the first 20 back-end engineers who built streaming. That was a very
[04:58] long time ago. Um, and so super excited that Lee's here and she'll be taking you through uh a lot of our story with this. >> Thank you, Bruce. So, first a little bit
[05:10] uh about myself. As Bruce shared, Bruce and I first get to know each other back in Netflix about 15 years ago. So for those of you who were customers of
[05:22] Netflix back then as Bruce shared we were the engineers responsible for authenticating you and delivering the uh movie streams to your device. So after Netflix I joined uh Facebook and
[05:36] Instagram spend about a decade there. So when GDPR came into force in 2018, I was at Facebook as I recall it felt like
[05:49] trying to refrain and while you still flying it and with the regulators watching over your shoulder, it's not fun. And uh um it was scaling fast. We try to manage uh trust crisis and
[06:03] rebuild credibilities and still shipping and moving fast shipping the products out. So I'm here talking about data privacy. It's not from any white paper.
[06:15] I've got battle scars on me.
[06:27] on the screen. Netflix was red, Facebook was blue, Instagram was multiolor and it loops. And now I'm back to red with data bras. So clearly this talk was
[06:40] inevitable. So let's ask this question. Simple question. Bruce already gave some hints. So in the AI era, what what has really changed about privacy? What has really
[06:54] changed? The three privacy challenges we are going to discuss today, right? Data uh residency, purpose limitation, and the data minimization. These all are
[07:07] familiar right to most of people. These problems are not new and the privacy requirements also vary from industry from regulation depending on your customer commitment and your geographies
[07:22] right they keep on evolving. This part is also not new. So what is really new is the operating model as Bruce shared like in AI now it force
[07:37] data governance to happen at a very different speed. So we have to act differently right agents can now reason across data they
[07:49] call tools for chaining they can uh move across systems they act at machine speed unlike human beings us right they don't wait for meetings they don't sleep they
[08:04] don't even need coffee breaks so that governance has to change too. Let's think about traffic for for a second. You cannot govern traffic by
[08:18] just looking a car in isolation, right? You need context. Is the car registered? Is the driver licensed? What road is it on? And what
[08:30] speed is driving at? Right? All these contexts are super important. And these contexts are what make car traffic governance possible. It's actually the
[08:42] same with data governance in the AI era. Think about it. You cannot govern data by just looking at the data alone.
[08:56] You cannot governance data by just picking the best you know model AI model in the world. You need a context. You need a context like what kind of
[09:08] data it is, right? Uh where this data lives and who and which agent is accessing it and why they are accessing it and where the data is going, right? Moving out of which boundary. So here is
[09:21] the main idea I want you to remember today. In the AI era, privacy is no longer a policy problem.
[09:33] Privacy becomes a context problem. Data bricks brings all these contact into the platform so the controls can happen at machine speed and then give
[09:46] you the choice how you want AI operate within the trust and the governor boundary. So that is a frame for today context control choice. I think Ali said that in
[10:01] the keynotes also. So context tells platform what really matters. Control makes the policies really real and the choice it ensures you are making sure
[10:15] how AI operate. So to all make all these concrete let's meet Eva and Atlas. First meet Eva. She is uh very friendly,
[10:28] always available support intelligence agent. She is built to answer real um business questions like why our European customers are seeing more failures and
[10:40] which account are impacted and tell me why. Right? These kind of questions are exactly the kind of questions we want AI to help with. But to answer them well, Eva needs a lot
[10:53] of data. Support tickets, product telemetry, um, support transcribe, transcri um, and meeting notes, email exchanges, all all sorts of data, a lot of more data
[11:05] needed. So, EVA is actually just one example I show here. In real enterprise like your companies, there will be thousands of agents like EVA. each focus on one
[11:18] specific domain. Each moving very fast, each is hungry for data. So the question becomes how do we let let um AI agents move fast without
[11:32] worrying about losing control? We also need Atlas. So Atlas is not one agent. Atlas is a governance network around agents like EVA.
[11:46] So in other words, we use agents governance agents like Bruce said, right? We want the agents on our side and do the data governance work.
[11:58] If every decision, you know, requires human reviews, it doesn't scale in today's world. Agent operates at a machine speed. So data governance have to operate at the
[12:11] same speed if not faster. Enterprise do not need a slower API AI. They need a AI which moves fast within this trusted and governed boundary. So
[12:24] now let's walk through three stories. Imagine each of you now are VP of support engineering. You noticed that there's a spike of support requests coming in from Europe customers. So you
[12:38] ask Eva this question. Are our European customers failing at a higher rate than customers at other regions? Simple question, right? Right.
[12:50] But to answer it, it's not simple. Eva needs all kind of the data which I um mentioned before. But this time is across all the regions in order to
[13:02] answer this question. So the platform now faces two choice to make. You can move the European data closer to
[13:14] the AI model or you move the AI model closer to the European data. So this is a data residency challenge. It's also a context problem, right? We
[13:28] need uh the information about where does the data live, where the computer should run, right? what make uh move across um the region boundary. If we only optimize
[13:40] for speed, the tempting answer is okay, let's just bring all the data, centralize them, run the AI model there and generate a global answer. It's fast, it's simple. In some
[13:53] case, it's okay, but not always. So, the right path is really depending on your uh industry, your customer commitment and applicable laws.
[14:07] So the platform route need really need the right context to help you make that kind of decision and atlas here uses region guards.
[14:19] Region guards evaluate all the information all the context where the data locates right where the computer runs um intermediate results where should be returned and where the data goes. If applicable policy requires the
[14:34] data to stay within Europe, EVA can still get the answer but the data ne never leaves the region and the compute happens within that configured boundary.
[14:48] So region guards are essentially equipped with all these context and turns residency from these uh static policy to the runtime controls. The wing here is not slower AI. The wing here is
[15:02] really faster AI excreted within the trusted boundary. So now um Eva gets you the answer through region guards. She confirmed European customers are indeed failing at
[15:15] a higher rate. He shows you a nice dashboard um with breown and historical trend. Same answer, same speed, very fast through agent. But the execution
[15:28] happened within the configured boundary. That is context, control and choice. Context tells us where the data lives
[15:40] and the control keeps execution within the allowed boundary and the choice ensures you can have the flexibility to decided you move the AI or model to the AI or AI to the model
[15:53] vice versa. Now you are VP of support engineering again you ask Eva which customers are impacted. I wanted the list for vendor
[16:07] sharing. Well, that's wrong. So, first let's easy one. You are support of um you VP of support engineering. You want the list for um customer outreach, right? The list for uh customer
[16:20] outreach. The audience is internal. The purpose here is for customer care as VP of support engineering. This sounds appropriate and is likely
[16:34] allowed but the same data can be uh different at a different risk level if purpose changes. So that brings us to the second privacy challenges is
[16:47] purpose limitation. So let's just change a little bit one phase in the in the question. Now this time you ask which customers are affected. I want the list for vendor
[17:00] sharing this time or maybe model training and or more more uh or for uh running a sales campaign. Same data, same customer list, same agent, same VP
[17:13] of support engineering is asking but purpose change it. When purpose changed the decision can be changed too. So this case is not allowed.
[17:28] Identity alone now is not enough. Right? The platform now has to ask who or which agent is asking why you are asking for the data and where the data is going and
[17:41] is this used really allowed for uh for this data. So identity purpose the things we talked about the destination these are all context and these are all the context
[17:54] which enables platform to do uh uh data governance. So here Atlas deploys two judges the inbound judge and outbound judge. The inbound judge runs before EVA even get
[18:08] access. It checks who and what agent is asking what purpose was declared and uh if the request should be allowed to
[18:20] access that data. If not, Eva never gets the opportunity to see the data. And the outbound judge runs after the answer is ready because sometimes the input is
[18:33] completely okay and safe but output may maybe not. Maybe it contains customer sensitive data. Maybe it should be masked and redacted. And maybe the output data no
[18:46] longer matches the originally declared purpose. So in a nutshell, the inbound agent governs access. The outbound uh agent, the judge governs uh data
[18:59] release. Purpose now is no longer just a documented policy. it becomes uh the context which enables data governance.
[19:11] So after the B judge checks, Eva gets you the list. You know, you uh need it to do your job um for customer outreach. Great. Same data, right? Purpose
[19:24] governed release. That's also context, control, choice. Again, context here tells us why the data is being asked and control checks the access and also data
[19:38] release. Choice lets you define what purpose should be allowed and what should not be allowed. And now you of support engineering asking Eva
[19:51] the last question. Are these impacted customers at risk? And tell me why I want a executive report. This sounds also like a very normal executive ask but Eva needs a lot
[20:06] of lot of data to answer this question. She needs raw support tickets, full product logs across regions, account records, um, meeting notes, um, and
[20:18] more. And Eva, he is not wrong here. In general, you know, we believe more data can help improve the answers. But more data also means more exposure and higher risk.
[20:32] So the question is not about how much data Eva can get. The real question is what is the minimal useful data actually
[20:44] even necessarily needed right what is actually needs here so that is a data minimization challenge better AI doesn't mean maximum data exposure
[20:56] better AI should mean that the minimum useful data with the right context so Eva is enabled to do her job.
[21:08] So here Atalas actually deploys a data minimization assembly line. Autotagger helps platform see the data and uh shape enforcer verifies the data
[21:24] and drift detector watches the data over time and the auditor proves what happened. see, verify, watch, prove. So that is
[21:37] how we achieve data minimization at AI speed. Not by asking every developer remember you know every rule of the privacy laws and not by waiting for human to act before uh every time like
[21:51] Eva needs data. So the platform shapes the data with the right context before Eva gets to see it. So first the order tagger auto tag helps
[22:03] platform see the data. So let's take a look at the raw product log on the screen right request ids workspace ids a bunch of ids all seems very harmless at
[22:16] first glance but then you notice something ah hidden inside is sensitive data user emails your customer name your customer maybe
[22:28] customer data too so the platform cannot govern data without you know being able to see it. So autotagger is is the way to classify data
[22:40] sensitivities. We use uh data uh brakes has data classification and governance tax features. You can think of sensitivity as as rings of data. The outside more
[22:53] outer rings is less sensitive and the inner rings is uh more sensitive. when you move closer to the inner uh ring um more controls are needed.
[23:05] So this classification is becomes important context which determines like what data can be uh curried, what data should be masked and redacted and uh
[23:17] what data can be exported and uh can uh can they used by which agent. So the key idea is simple. So classification is not just a label
[23:31] classification it becomes part of the context which platform needs to do its governance job. Next shape enforcer. Shape enforcer helps a platform verify the data. On the
[23:46] screen is an example meta store ID is labeled as class three here. uh is one of the rings which means it's saved for internal use and its expected shape is a
[24:00] UID at runtime the shape enforcer checks the real value of this field if the value is indeed UID great the passes and
[24:12] agents can use it but if it's not UID it contains email SQL query or free um input from from users then it gets reducted.
[24:24] So even though the label says it's safe but the reality changes right our system evolves our code changes and our login
[24:36] changes new feature released so the new values could appear over time. A field once was complete safe but suddenly one day it becomes sensitive data. So
[24:49] essentially the field the data the data shape changed and the uh shape enforcer basically what he does is try to compare the field uh with what it claims to be to what it
[25:03] actually is. Um make sure they matches and in simple words labels describe intent and shape verifies reality.
[25:16] Both label and shape are important context for the platform. Then the platform can use these context to catch mismatch and reduct the data before agents can safely use them.
[25:31] Next is drift detector. Drift detector helps the platform monitor the data stream over time. On the screen is a string of data used to be clean product
[25:44] telemetry as log login events uh query events error events no PII no email specifically then one day a customer's
[25:56] email starts appearing what changed wow turns out a product team could you know launch a debugging um change start logging stuff and then
[26:08] sensitive sensitive data got into the stream. That's a drift. So basically yesterday the data was completely fine but today the stream starts contain sensitive data.
[26:28] So drift detector watches the data stream over time. When it sees an um very abnormal um unexpected data pattern, it detects it. It alerts the team and it take actions to uh mask it
[26:41] or even delete it. Safe yesterday doesn't guarantee safe today, right? Data stream changes, our product changes, login changes, agents now have coding agents even speeding up
[26:54] these change uh for us. So when context changes, the data governance have to change with that context.
[27:08] The last one um the final one is auditor. Auditor proves what has happened. Earlier uh remember Eva uh got asked by the support of engineering uh um VP of support engineering to give him the or
[27:22] her a customer's uh list for support outreach. In that request, the requester is VP of support engineering, you know, or any support engineer from support engineering organization and the purpose
[27:35] was for um uh support outreach. So the request was approved but then later the same request came in. It claims to be also for the support
[27:48] outreach, right? The request was the same. The customer list was the same. But wait look it came from a marketing analyst in a marketing organization.
[28:00] Even though the words were exactly the same but the context about the requesttor the role the organization this request is has changed. So in this
[28:12] case the request is blocked because the claimed purpose is not enough and there's more context we have to consider in the platform.
[28:25] So the auditor auditor essentially does two things. It records what happened and is constantly uh detect suspicious um behaviors. It records pretty much everything who request what right which
[28:38] policy applied. Um and it it's got rejected why it's got approved why. So data bras lineage and audit logs really enables this governance that turn governance into evidence.
[28:51] Um why are we doing this? Because privacy is really not about just you know doing the right thing. Privacy is also requires us to show and evidence like we have done the right thing.
[29:04] And now like it's not like we believe we have done the right thing. We have also have to have the evidence showing okay here is what happened here is the reason and here is the record
[29:18] that matters to security legal privacy teams is also matters to our customers. So now trust is becomes the evidence you can show.
[29:30] Okay. Another way um to think about data minimization problem is I call these shift right model right. You can think of data as uh water flowing downstream
[29:42] on the upstream on the most um uh that side is uh powerful but very turbulent and just like a raw data right it has a lot of high value signals but very
[29:55] risky. Um so as data moves through data bras the platform progressively reduce the risk by tagging by filtering by redacting masking right and
[30:09] aggregating and summarizing the data. So when when what reaches to EVA is like like tahoe on this side it's calm and clean and trusted.
[30:23] So no no no raw data by default, no maximum data by default and only the minimal data, the minimal useful data you can get.
[30:40] So what does all this mean? The privacy challenges we talked about are not new and what really is new is the operating model comes with it is the operating speed is very different in the
[30:54] agent era privacy is a context problem. Data bras brings that context into the platform so governance can happen at
[31:06] machine speed. models reason, data grants, agents act and the platform governance. The future of the AI is not more and more um
[31:20] smarter agents. The future of AI is more and more trusty agents. Trust is not happen by accident and trust has to be engineered into the data platform.
[31:34] That's a data bricks. Back to you Bruce. Thank you.
[31:46] >> So, I hope we have you convinced that privacy is a context problem. And you know, if you've been at the conference, you've you've probably heard context, control, and choice. And so, I wanted to dive in. We could easily do talks on
[31:59] each of these, but you've all heard some of these things during the the keynotes and throughout different uh aspects of data AI summit. And so agents is a control pro like privacy is a context
[32:11] problem. Agents is a control problem, right? Um control comes in many forms. So we can use things like ales access controls for for each of us. Uh but we
[32:24] also for us we actually want to use agents on the front line as a form of control. Okay, that's the whole agents on our side. Um and then you know cost, speed and accuracy is a choice problem,
[32:38] right? So uh you've seen some of the things around uh AI gateway uh Unity catalog AI gateway as well as like omnigent and stuff like that. Um and that's sort of like where the next
[32:50] horizon is uh is what is the best models that you should be using uh in this case right so in the privacy case um you know that's something that we've engineered
[33:02] to be able to swap in and out right so today I think I think today we're using opus right now u but we're also testing things out because we want it to be faster we want it to be more effective
[33:15] um and more cost effective right uh so That's actually one of the things we're actually looking at Sonnet right now um because we think that's probably good enough and it's probably a little bit faster for us. Uh but the point is is
[33:27] that that choice is going to evolve over time. Like I know like GPT6 is going to come out and uh you know Anthropic has their own naming convention. I'm sure there's going to be more models. There's going to be more open source models as
[33:40] well. Um and so that's why having something like the gateway built into our architecture from the beginning uh actually reserves us so we can swap in and out that choice of model without
[33:52] anyone else noticing and stuff and we can actually run some experimentation on that. So so I hope you enjoyed our talk. Um I have a little bit of closing for you all. Uh and I will also tell you
[34:04] this is thanks to generative AI as well. May your data be safe and your context clear. May your agents move fast, governed by
[34:16] their peer. May residency hold where your the model must run. May your true purpose guide every task that is done.
[34:29] May your platform grant control so all can believe. May trust make your AI smarter. And may the future be fast, governed, and bright.
[34:42] Thank you very much.

Learn more about the Databricks Data and AI platform.

The information provided herein is for general informational purposes only and may not reflect the most current product capabilities or configurations.