How to make GDPR tag values searchable while limiting sensitive data access?

PDE By islever Editorial Last updated

Short answer

C Create the “gdpr” tag template with public visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.

Question

You have a BigQuery dataset named “customers”. All tables will be tagged by using a Data Catalog tag template named “gdpr”. The template contains one mandatory field, “has_sensitive_data”, with a boolean value. All employees must be able to do a simple search and find tables in the dataset that have either true or false in the “has_sensitive_data’ field. However, only the Human Resources (HR) group should be able to see the data inside the tables for which “has_sensitive data” is true. You give the all employees group the bigquery.metadataViewer and bigquery.connectionUser roles on the dataset. You want to minimize configuration overhead. What should you do next?
  1. Create the “gdpr” tag template with private visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
  2. Create the “gdpr” tag template with private visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
  3. Create the “gdpr” tag template with public visibility. Assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data. Correct Answer
  4. Create the “gdpr” tag template with public visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.

Key Takeaways

The exam tests whether you know that public tag-template visibility makes tags searchable by everyone without extra IAM grants, while BigQuery dataViewer controls data-level access.

To let all employees search BigQuery tables by GDPR tag field while restricting sensitive table data to HR, use a public tag template and grant bigquery.dataViewer only to HR. Community consensus confirms option C as the minimum-overhead configuration.

Common mistake: Choosing D to explicitly grant datacatalog.tagTemplateViewer to all employees is redundant when the template is public and adds unnecessary configuration overhead.

Expert Analysis

Why the Answer Is Correct

Option C is correct because creating the "gdpr" tag template with public visibility automatically allows all employees to see the tag values, including the "has_sensitive_data" field, during Data Catalog searches. The existing roles already granted to all employees (bigquery.metadataViewer and bigquery.connectionUser) let them view metadata but not table data, so sensitive data access is not exposed. Assigning bigquery.dataViewer only to the HR group on tables with "has_sensitive_data" set to true enforces the data-access restriction while keeping configuration overhead minimal.

Why the Other Options Are Wrong

Options A and B use private visibility, which would require an extra explicit grant to all employees before they could see the tag values, adding overhead and creating a dependency on IAM assignments. Option B's private visibility plus datacatalog.tagTemplateViewer grant could work but is not the minimal approach requested. Option D includes public visibility but also assigns datacatalog.tagTemplateViewer to all employees, which is unnecessary because public visibility already grants the needed view access; this violates the requirement to minimize configuration overhead.

Community Comment Notes

Commenter Raad (comment 1) correctly summarized C: public visibility ensures searchability and HR-only bigquery.dataViewer restricts data. Commenter 5 noted that D works but is not required, since adding tagTemplateViewer is unnecessary when the template is public. Commenter 7 also highlighted that A and B prevent employees from using the tag, and D adds an unnecessary role assignment. Commenter 2 raised PII concerns about private visibility, but the exam scenario only requires restricting data access, not tag metadata access, so public visibility is appropriate here.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question says 'minimize configuration overhead,' look for the option that relies on defaults such as public tag-template visibility instead of adding explicit IAM grants to all employees. Always separate metadata visibility (Data Catalog tags) from data access (BigQuery roles like bigquery.dataViewer).

Community Votes

C
83%
D
17%

83% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. raaad 👍 18 Answered C
    - The most straightforward solution with minimal configuration overhead. - By creating the "gdpr" tag template with public visibility, you ensure that all employees can search and find tables based on the "has_sensitive_data" field. - Assigning the bigquery.dataViewer role to the HR group on tables with sensitive data ensures that only they can view the actual data in these tables.
  2. scaenruy 👍 4 Answered D
    D. Create the “gdpr” tag template with public visibility. Assign the datacatalog.tagTemplateViewer role on this tag to the all employees group, and assign the bigquery.dataViewer role to the HR group on the tables that contain sensitive data.
  3. tibuenoc 👍 4 Answered B
    If you working with PII, We can't granted public access. So Private Visibility for the Tag Template its the best option. Check it https://cloud.google.com/data-catalog/docs/tags-and-tag-templates
  4. d11379b 👍 2 Answered C
    While D works well, it is not obligated to give all employees the role of tagTemplateViewer, as it will give them the view permission for tag templates as well as the tags created by the template. However, Tags are a type of business metadata. Adding tags to a data entry helps provide meaningful context to anyone who needs to use the asset.And public tags provide less strict access control for searching and viewing the tag as compared to private tags. Any user who has the required view permissions for a data entry can view all the public tags associated with it. View permissions for public tags are only required when you perform a search in Data Catalog using the tag: syntax or when you view an unattached tag template.
  5. meh_33 👍 2 Answered C
    This Guy Raasd is mostly correct with explanation thanks mate.
Show 3 more comments
  1. Pime13 👍 1 Answered D
    Option C: Public Visibility: Ensures that all employees can see the tags and their values. Data Viewer Role for HR: Restricts access to the data inside the tables with sensitive data to the HR group. Option D: Public Visibility: Ensures that all employees can see the tags and their values. Tag Template Viewer Role: Explicitly grants the datacatalog.tagTemplateViewer role to the all employees group, ensuring they can view the tags. Data Viewer Role for HR: Restricts access to the data inside the tables with sensitive data to the HR group. While both options provide public visibility for the tags and restrict data access to the HR group, Option D explicitly grants the datacatalog.tagTemplateViewer role to the all employees group, ensuring they can view the tags and perform searches based on the "hs_sensitive_data" field.
  2. iooj 👍 1
    A - employees cannot use the tag B - increases the configuration overhead C - exactly what we need D - unnecessary role assignment, the tag template is already visibile
  3. JyoGCP 👍 2 Answered C
    I'll go with raaad's answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to establish consistent BigQuery spend?

S-grade

Triggering Airflow DAGs Reactively in Private Cloud Composer

S-grade

How to resolve Cloud Composer 2 worker pod evictions and task failures?

S-grade

Which Google Cloud database for on-prem PostgreSQL with analytics?

S-grade

← Back to PDE Study Guide