Cloud Dlp Conditional Table Deidentification

What this solution is

This solution uses Cloud DLP's structured tabular de-identification capabilities within DeidentifyConfig, specifically using RecordTransformations and FieldTransformations with a RecordCondition.

How it meets the requirements

• Targeting specific columns: Defining FieldId entries for PATIENT and FACTOID within FieldTransformation ensures that de-identification inspection is scoped precisely to the relevant columns.
• Detecting and masking PII: Configuring infoTypeTransformations with PERSON_NAME and applying a primitive transformation of ReplaceWithInfoTypeConfig replaces matching personal names with the infoType label [PERSON_NAME].
• Conditional execution: Attaching a RecordCondition with a relational operator of GREATER_THAN on the AGE field (value 89) ensures the transformation executes only on rows meeting the compliance threshold while leaving others unaltered.

Key advantages and capabilities

• Granular row-and-column filtering: Combines column-level transformation targeting with row-level conditional evaluation.
• Reusable pipeline configuration: Can be packaged into a reusable Cloud DLP De-identification template and deployed across batch or streaming Dataflow pipelines.
• Low analytical disruption: Preserves analytical utility for non-matching records while enforcing strict privacy transformations on high-risk records.
• Native structured data parsing: Operates directly on structured Table objects without requiring unnesting or flat string concatenation.

Why this is optimal

This approach directly leverages Cloud DLP's native conditional record evaluation without requiring custom conditional routing code in the ingestion pipeline, ensuring consistent policy enforcement directly at the data protection layer.