How to make GDPR tag values searchable while limiting sensitive data access?

You have a BigQuery dataset named “customers”. All tables will be tagged by using a Data Catalog tag template named “gdpr”. The template contains one mandatory field, “has_sensitive_data”, with a boolean value. All employees must be able to do a simple search and find tables in the dataset that have either true or false in the “has_sensitive_data’ field. However, only the Human Resources (HR) group should be able to see the data inside the tables for which “has_sensitive data” is true. You give the all employees group the bigquery.metadataViewer and bigquery.connectionUser roles on the dataset. You want to minimize configuration overhead. What should you do next?

Create the “gdpr” tag template with private visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
Create the “gdpr” tag template with private visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
Create the “gdpr” tag template with public visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data. Source Reference Answer
Create the “gdpr” tag template with public visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.

Community Votes

83%

17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests whether you know that public tag-template visibility makes tags searchable by everyone without extra IAM grants, while BigQuery dataViewer controls data-level access.

To let all employees search BigQuery tables by GDPR tag field while restricting sensitive table data to HR, use a public tag template and grant bigquery.dataViewer only to HR. Community consensus confirms option C as the minimum-overhead configuration.

Choosing D to explicitly grant datacatalog.tagTemplateViewer to all employees is redundant when the template is public and adds unnecessary configuration overhead.

Community Discussion (8 comments)

raaad 👍 18 Selected: C

The most straightforward solution with minimal configuration overhead. - By creating the "gdpr" tag template with public visibility, you ensure that all employees can search and find tables based on the "has_sensitive_data" field. - Assigning the bigquery.dataViewer role to the HR group on tables with sensitive data ensures that only they can view the actual data in these tables.

Pime13 👍 1 Selected: D

Option C: Public Visibility: Ensures that all employees can see the tags and their values. Data Viewer Role for HR: Restricts access to the data inside the tables with sensitive data to the HR group. Option D: Public Visibility: Ensures that all employees can see the tags and their values. Tag Template Viewer Role: Explicitly grants the datacatalog.tagTemplateViewer role to the all employees group, ensuring they can view the tags. Data Viewer Role for HR: Restricts access to the data inside the tables with sensitive data to the HR group. While both options provide public visibility for the tags and restrict data access to the HR group, Option D explicitly grants the datacatalog.tagTemplateViewer role to the all employees group, ensuring they can view the tags and perform searches based on the "hs_sensitive_data" field.

meh_33 👍 2 Selected: C

This Guy Raasd is mostly correct with explanation thanks mate.

iooj 👍 1

A - employees cannot use the tag B - increases the configuration overhead C - exactly what we need D - unnecessary role assignment, the tag template is already visibile

d11379b 👍 2 Selected: C

While D works well, it is not obligated to give all employees the role of tagTemplateViewer, as it will give them the view permission for tag templates as well as the tags created by the template. However, Tags are a type of business metadata. Adding tags to a data entry helps provide meaningful context to anyone who needs to use the asset.And public tags provide less strict access control for searching and viewing the tag as compared to private tags. Any user who has the required view permissions for a data entry can view all the public tags associated with it. View permissions for public tags are only required when you perform a search in Data Catalog using the tag: syntax or when you view an unattached tag template.

JyoGCP 👍 2 Selected: C

I'll go with raaad's answer

tibuenoc 👍 4 Selected: B

If you working with PII, We can't granted public access. So Private Visibility for the Tag Template its the best option. Check it https://cloud.google.com/data-catalog/docs/tags-and-tag-templates

scaenruy 👍 4 Selected: D

D. Create the “gdpr” tag template with public visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option C is correct because creating the "gdpr" tag template with public visibility automatically allows all employees to see the tag values, including the "has_sensitive_data" field, during Data Catalog searches. The existing roles already granted to all employees (bigquery.metadataViewer and bigquery.connectionUser) let them view metadata but not table data, so sensitive data access is not exposed. Assigning bigquery.dataViewer only to the HR group on tables with "has_sensitive_data" set to true enforces the data-access restriction while keeping configuration overhead minimal.

Why the Other Options Are Wrong

Options A and B use private visibility, which would require an extra explicit grant to all employees before they could see the tag values, adding overhead and creating a dependency on IAM assignments. Option B's private visibility plus datacatalog.tagTemplateViewer grant could work but is not the minimal approach requested. Option D includes public visibility but also assigns datacatalog.tagTemplateViewer to all employees, which is unnecessary because public visibility already grants the needed view access; this violates the requirement to minimize configuration overhead.

Community Comment Notes

Commenter Raad (comment 1) correctly summarized C: public visibility ensures searchability and HR-only bigquery.dataViewer restricts data. Commenter 5 noted that D works but is not required, since adding tagTemplateViewer is unnecessary when the template is public. Commenter 7 also highlighted that A and B prevent employees from using the tag, and D adds an unnecessary role assignment. Commenter 2 raised PII concerns about private visibility, but the exam scenario only requires restricting data access, not tag metadata access, so public visibility is appropriate here.

Official Reference

Exam Strategy

When a question says 'minimize configuration overhead,' look for the option that relies on defaults such as public tag-template visibility instead of adding explicit IAM grants to all employees. Always separate metadata visibility (Data Catalog tags) from data access (BigQuery roles like bigquery.dataViewer).

Related Analysis

← Back to PDE Study Guide