BigQuery introduces IAM data governance tags for column-level security
BigQuery has released a preview of IAM data governance tags, a new method for column-level access control that improves upon existing policy tags. These tags offer global scope, automatic disaster recovery replication, hierarchical classification up to five levels deep, and decoupled governance for more flexibility. This feature is available to all BigQuery customers and is particularly beneficial for those managing complex data ecosystems and seeking to enhance their data protection strategies.
- →Introduce data governance tags in BigQuery
- →Apply data governance tags using JSON schema or SQL
- →Global scope and regional enforcement for data governance tags
- →Managed disaster recovery for security policies
- →Hierarchical security classification for data
Features (2) ›
- Introduce data governance tags in BigQuery
BigQuery now offers a preview of IAM data governance tags, a new approach to column-level security that builds on Google Cloud's Resource Manager infrastructure. This feature allows for more scalable and robust management of access controls and data protection within BigQuery.
- Apply data governance tags using JSON schema or SQL
Users can attach data governance tags to BigQuery columns by updating table schemas via JSON files and the bq CLI, or directly using SQL statements for creation and modification.
Enhancements (4) ›
- Global scope and regional enforcement for data governance tags
Unlike regional-only policy tags, data governance tags are global, enabling a single tag key:value pair defined at the organization level to be used across all projects and regions.
- Managed disaster recovery for security policies
Data governance tags and their associated data policies are automatically replicated to secondary regions, ensuring security posture persists during failovers and disaster recovery scenarios.
- Hierarchical security classification for data
Data governance tags support a hierarchical tree structure up to five levels deep, enabling more granular data classification and inheritance for precise access control.
- Decoupled governance for flexible data onboarding
Data can be tagged and classified before security policies are enforced, providing increased flexibility during the data onboarding process.
https://cloud.google.com/blog/products/data-analytics/level-up-your-column-level-security-using-iam-data-governance-tags-in-bigquery/
Related releases
- Config Connector 1.154.1 Adds New Alpha Resources and Field Support Google Cloud release notes ·
- Google Cloud AI Infrastructure and Orchestration Updates - July 2026 Google Cloud Blog ·
- Data Studio Conversational Analytics GA, adds BigQuery integration Google Cloud release notes ·
- Cortex Framework v7 GA with modular architecture, Dataform, and AI features Google Cloud release notes ·
- BigQuery: Audit UI query result downloads Google Cloud release notes ·
- BigQuery Data Transfer Service adds incremental Klaviyo transfers Google Cloud release notes ·