How do we secure PII data?

Summary

• Securing personally identifiable information (PII) on the Databricks Data Intelligence Platform is built on Unity Catalog, which finds, tags, and controls access to sensitive data across all your data and AI assets.
• Data classification uses AI to automatically detect PII types such as email addresses, phone numbers, Social Security numbers, credit card numbers, and names, then applies system-managed tags.
• Attribute-based access control (ABAC) policies use those tags to apply column masks and row filters automatically across entire catalogs and schemas, so masking follows the data as it grows.
• Column masks redact or hash values and row filters restrict rows at query runtime, so different users see only what their role permits, consistently across dashboards, queries, and jobs.
• Data is encrypted at rest with AES-256 (with optional customer-managed keys), and every query and data access is recorded in system tables for audit and compliance.

How do we secure PII data?

Securing personally identifiable information (PII) means being able to find it, control who can see it, protect it at rest and in use, and prove who accessed it. On the Databricks Data Intelligence Platform, these controls are unified in Unity Catalog, the single governance layer for data and AI. You classify and tag sensitive data, define policies that mask or filter it automatically, encrypt it, and audit every access, so PII protection is consistent no matter which tool, notebook, dashboard, or AI agent touches the data.

Why the Databricks Data Intelligence Platform for securing PII

• Automatically find and tag PII. data classification uses AI, combining pattern recognition, metadata analysis, and large language models, to detect PII types such as email addresses, phone numbers, Social Security numbers, credit card numbers, and person names. It scans your catalog and then incrementally rescans only new or changed tables, and your data never leaves your environment during classification. Detected PII is labeled with system-managed classification tags.
• Enforce policy with governed tags. Governed tags add administrator-defined policy on top of classifications, controlling which tag values are permitted and who can assign or remove them, so security controls stay consistent and cannot be silently removed. Built-in classifiers align to standards such as GDPR, HIPAA, and PCI, and you can add custom classifiers.
• Protect data automatically with ABAC. Attribute-based access control (ABAC) policies evaluate tag conditions and automatically apply column masks and row filters to every matching table across entire catalogs and schemas. A single policy can protect many tables, and newly tagged data is protected as soon as the tags are in place, so coverage keeps up as data grows.
• Mask and filter at query time. Column masks redact or hash a value and row filters restrict which rows are returned, evaluated dynamically based on the querying user's group. For example, support agents can see masked Social Security numbers while compliance teams see full values, and the same protection applies across dashboards, ad hoc queries, and downstream jobs.
• Mask PII in AI workflows. The ai_mask AI function redacts specified entities from free text directly in SQL, which helps remove PII from data used in prompts, retrieval, and AI outputs.
• Encrypt at rest. Data is encrypted at rest with AES-256, and you can bring your own customer-managed keys for an added layer of control.
• Audit every access. system tables record audit logs of queries and data access so you can show exactly when PII was accessed and by whom, which supports compliance reviews and investigations.

Getting started

• Turn on data classification to discover and tag PII across your catalog.
• Define ABAC policies with column masks and row filters that reference your tags.
• Configure customer-managed keys and review audit activity in system tables.
• Read Find sensitive data at scale with data classification in Unity Catalog.

FAQs

How does Databricks find PII automatically?

Unity Catalog data classification uses AI, combining pattern recognition, metadata analysis, and large language models, to detect PII types such as emails, phone numbers, Social Security numbers, credit card numbers, and names, then applies system-managed tags. Data stays in your environment during classification.

How do we make sure masking keeps up as data grows?

ABAC policies apply column masks and row filters to every table matching a tag condition across whole catalogs and schemas. Because classification tags new data continuously, newly tagged columns are protected automatically without per-table configuration.

Can different users see different views of the same PII?

Yes. Column masks and row filters are evaluated at query runtime based on the user's group, so, for example, support agents can see masked values while compliance teams see full values, consistently across dashboards, queries, and jobs.

How is PII protected at rest and audited?

Data is encrypted at rest with AES-256, with optional customer-managed keys, and system tables record audit logs of every query and data access so you can report exactly when PII was accessed and by whom.