Google Cloud adds BigQuery governance tags in preview

Google Cloud has introduced data governance tags in preview for BigQuery, adding a new way to apply column-level security.

The update gives BigQuery users a tagging model based on Google Cloud Identity and Access Management Resource Manager tags, rather than the policy tags many customers have used to protect sensitive fields such as personally identifiable information.

BigQuery customers have typically relied on policy tags to control access to specific columns, but more complex data environments have exposed limits in that approach. These include managing taxonomies across multiple regions, supporting disaster recovery, and aligning column security with broader governance rules.

Under the new model, organisations create a tag key in IAM and designate it for data governance use in BigQuery. They can then build a hierarchy of tag values and attach them directly to individual table columns.

One of the main changes is scope. Policy tags are regional, while data governance tags are global, allowing a single tag key-value pair to be defined at the organisation level and applied across projects and regions.

Tags and related data policies are also replicated to secondary regions to preserve security settings during failover. That addresses a common problem for businesses that want access controls to remain intact when workloads move between regions for resilience.

How It Works

The process has three stages. First, an administrator creates a data governance tag key in IAM and adds tag values beneath it, with support for a hierarchy up to five levels deep.

This structure allows broad labels and more granular subcategories to sit within the same hierarchy. A company, for example, could classify data under a parent tag such as PII and then create child tags for narrower categories such as financial data or email addresses.

Second, the tags are attached to columns in BigQuery tables. This can be done by exporting a table schema to JSON, editing it to include the relevant tag mappings, and then updating the table, or by using SQL statements to assign tags directly to columns.

Users can also remove a column tag by resetting the option to an empty list. The INFORMATION_SCHEMA COLUMNS view can then be queried to see which tags are attached to which fields.

Policy Layer

The third stage is to create a BigQuery data policy tied to the tag values. These policies remain regional even though the data governance tags themselves are global, so the policy must be created in the same region as the BigQuery table it governs.

The policy determines who can view sensitive column data and whether they receive the raw value or a masked version. Examples include a SHA256 masking policy for columns tagged as PII, a raw-access policy for specific users, and a null-masking policy for columns tagged as private.

The system still depends on baseline access to the table. A user must already have permission to access the table before the data policy determines whether that person can see the original column contents, a masked value, or nothing at all.

That layered design means the column policy acts as a second control rather than a replacement for dataset or table permissions. In practice, an organisation can give staff standard table access while restricting only the most sensitive fields to named individuals or groups.

Governance Shift

A notable element of the new approach is the separation of classification and enforcement. Teams can tag and organise column data before deciding whether to create a policy that enforces access restrictions, which could make it easier to prepare data inventories before applying security rules.

The use of IAM Resource Manager infrastructure also suggests Google is trying to align BigQuery column governance more closely with controls used elsewhere in Google Cloud. For companies with central security teams, that may reduce the operational split between analytics governance and broader cloud administration.

The preview arrives as cloud data estates become more distributed and businesses face tighter scrutiny over how personal and confidential information is handled. Column-level controls have become a key part of data governance in analytics platforms because many organisations want analysts and application teams to query shared datasets without exposing every field in full.

The new tag structure supports inheritance and more detailed classification while giving organisations a single tagging framework across regions. Tags can also be applied before any access policy is activated, allowing governance teams to classify data in advance of policy decisions.

For users managing BigQuery environments across multiple locations, the distinction between globally defined tags and region-specific policies will be central to deployment. The model broadens the scope of classification, but enforcement still depends on creating the correct regional policy for each protected table.

Access is granted only to the grantees named in the policy, while all others are denied access to sensitive column data.