Classifications and sensitive data
Marks like Contains PII, where they are recorded and where they show.
On this page
Some values tell people to handle an asset with care, such as a column that holds personal data or a table classified Confidential. This page explains where to record these marks, where KRISID shows them, and how to find the tables that hold marked data.
What a mark is
A mark is an attribute value that your repository has declared sensitive. In the starter model there are two:
| Attribute | Values that count as a mark |
|---|---|
| Contains PII | Yes |
| Classification | Confidential, Restricted |
Only the declared values are marks. A column classified Public or Internal is classified, but it isn't flagged.
Your repository may use different attributes, for example an information sensitivity code or a retention class. What counts as sensitive is set by an administrator in the metamodel, in the Sensitive values column of the Attribute types sheet. Nothing else needs changing: every screen below shows whatever your repository has declared. See The metamodel.
Before you start
- To record a mark you need Edit attributes (ASSET_EDIT) on the asset, as for any other value. See Editing an asset.
Record a mark on a column
Personal data is recorded where it actually is: on the column. In the starter model, Contains PII is an attribute of columns (and of data attributes and output ports), not of tables.
- Open the column, for example from its table's page or from Ask.
- Under Attributes, click the value beside Contains PII.
- Choose Yes and press Save.
Classification can be set on tables and views as well as columns. Set it where the decision applies. A whole table can be Restricted, or just one column in it.
To mark many columns at once, use Loading from Excel. Harvested columns aren't in the workbook, so their marks are set on each column's page.
On a business asset, such as a data attribute or an output port, a mark records the business view. On a column, it records where the data physically sits. It's worth recording both, and linking the data attribute to the column it is realised by. See The business layer.
Where marks show
On results in Ask
A result that carries a mark shows it as a chip: Contains PII, or the value itself, such as Confidential. Hover over the chip to see the attribute behind it. The chip appears on any kind of result, including a business term someone has classified, not only on tables and columns.
On the asset page
The value appears under Attributes like any other.
In answers to "where is it"
When you ask Ask where some data lives, the answer gives a table to query and a query to start from. If the table holds marked columns, a careful line appears above the query, before you copy it. For example: 2 columns marked Contains PII (CUSTOMER_NAME, EMAIL) · 1 column marked Classification Confidential (TENANT_ID). If a marked column is in the starting query itself, a line under the query names it and suggests you drop it if you don't need it.
Who can read it
When KRISID knows which roles in the source can read the table, a who sees it line says whether those roles can also read the marked columns. Often the answer is Every one of those roles: nothing is granted below the table, so anyone who can read the table can read the personal data in it.
Find tables that hold marked data
A table holding a column marked Contains PII is a table to handle carefully. Ask treats it that way.
- In Ask, type something like tables with PII in Banking.
- If no table is itself marked, the answer says so: No table in Banking & Financial Services is itself marked Contains PII.
- Below that, it lists the tables that hold marked columns, with the columns that put them there. For example: holds CIF_NUMBER, CUSTOMER_NAME, EMAIL, marked Contains PII.
It also offers related questions with their counts, such as the same question asked of columns, each one click away. See Ask: search and questions.
Marks and the warehouse's own tags
KRISID's marks and the source's tags are separate.
- Source tags are what the warehouse itself says. They appear under Source tags on an asset page, can't be edited in KRISID, and are refreshed by each harvest.
- Marks are what your stewards decide in KRISID.
An administrator can write KRISID's classifications back onto Snowflake as tags, so masking and access policies there can use them. Each push is previewed before it is written. See Pushing tags back to Snowflake.
Good to know
- A mark is a label, not a lock. KRISID never reads your data and doesn't stop anyone querying a marked table. It makes sure people are told first.
- If Ask finds nothing for tables with PII, check whether PII has been recorded on the columns at all.
- Changing a mark is recorded in the asset's History like any other edit. It can also start a review workflow if one is set up. See Requests and approvals.