Skip to main content

Sample Data Handling Using PII Tags

In OpenMetadata, sensitive information is protected through automatic masking of sample data when PII (Personally Identifiable Information) tags are applied.

How It Works

  • If a PII tag is applied to a specific column:
    • Only that column’s sample data will be masked and displayed as ******** in the UI.
PII Tag Application at Column Level
  • If a PII tag is applied at the table level:
    • All columns within that table will have their sample data masked automatically.
PII Tag Application at Table Level This behavior ensures that sensitive data is not exposed through sample data views in OpenMetadata.

Example

When the tag is applied at the table level, the result would be:

How to Apply PII Tags

  1. Navigate to the column or table in the OpenMetadata UI.
  2. Apply the PII.Sensitive tag via the tagging options.
PII.Sensitive Tagging
  1. Ensure auto-classification or manual tagging captures the correct columns during ingestion.

Access Control

Two separate controls protect sample data:
  • Permission to view sample data. Sample data has its own ViewSampleData operation, and ViewAll includes it. A user without it still sees the Sample Data tab, but the tab shows a permission-denied message. You can’t hide the tab for a role.
  • PII masking. A column tagged PII.Sensitive is masked unless the user is an admin, a bot, or an owner of the table. Having ViewSampleData alone doesn’t unmask the values.
For sensitive environments:
  1. Tag sensitive columns, or the whole table, with PII.Sensitive.
  2. Restrict who can view sample data. The default OrganizationPolicy-ViewAll-Rule gives every user ViewAll, which includes ViewSampleData. Add a Deny rule for ViewSampleData to the roles that shouldn’t see it, as in Use Case 11, or edit that rule.
  3. Make sure only the people who need to see the real values own sensitive tables.
For more information about permissions, see Resource Scope and Operations Reference.