Sensitive Data Protection release notes

The ANTHROPIC_API_KEY, GEMINI_API_KEY, and OPENAI_API_KEY infoType detectors are available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

The CRIME_STATUS infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

If you leave InfoType.version unset or set it to stable when setting the MEDICAL_ID infoType in your InspectConfig, Sensitive Data Protection includes MEDICAL_RECORD_NUMBER findings as type MEDICAL_ID in the scan results.

You can still use the old functionality by setting InfoType.version to legacy for the next 90 days.

The SWITZERLAND_PASSPORT infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

You can configure Sensitive Data Protection to detect specific file labels, which can represent Google Drive labels or Microsoft sensitivity labels. For more information, see Create a custom metadata label detector.

Image safety classification infoTypes are now supported in ExcludeByImageFindings and AdjustByImageFindings detection rules.

For information about configuring these rules, see Modifying infoType detectors to refine scan results.

Image scanning is available in the following cloud regions:

• asia-southeast1
• us-east4
• us-west1

For more information, see Locations that support image scanning.

Between July 2025 and June 2026, some table data profiles saved to BigQuery contained an incorrect 1970-01-01 timestamp instead of NULL in expiration_time for tables that don't expire. This issue has been fixed. New exports of table data profiles show the correct expiration timestamps.

Added support for inspecting and de-identifying batched content. You can now include a BatchContentItem in your ContentItem requests.

The OBJECT_TYPE/PERSON/SIGNATURE infoType detector is available in global and the asia, europe, and us multi-regions. For more information about all infoTypes, see InfoType detector reference.

Added support for inspecting and de-identifying conversational content. You can now include a Conversation in your ContentItem requests.

If you set InfoType.version to latest when including the MEDICAL_ID infoType in your InspectConfig, Sensitive Data Protection will now include MEDICAL_RECORD_NUMBER findings as type MEDICAL_ID in the scan results.

You can still use the old functionality by setting InfoType.version to stable. In 30 days, the new functionality will be promoted to stable.

You can configure Sensitive Data Protection to detect specific client-provided metadata. For more information, see Create a custom metadata label detector.

The USER_NAME infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

The CRIME_STATUS infoType detector is available in Preview. For more information about all infoTypes, see InfoType detector reference.

You can configure Sensitive Data Protection to detect specific metadata labels in your content. For more information, see Create a custom metadata label detector.

Sensitive Data Protection can discover and profile Vertex AI tuning jobs. For more information, see Sensitive data discovery for Vertex AI.

The following features are in General Availability:

• Adjustment rules, which let you customize the likelihood of findings based on their context. Adjustment rules support text-based and image-based operations.
• Image-based exclusion rules, which let you refine your image inspection results by excluding findings based on their spatial relationships with other findings.
• Enhanced rule ordering, which lets you chain rules based on the order you specify them in the ruleset.

For information about configuring these rules, see Modifying infoType detectors to refine scan results.

The KOREA_BRN infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

Sensitive Data Protection is available in the asia-southeast3 (Bangkok) region. For more information, see Sensitive Data Protection locations.

The following infoType detectors are available in global and the asia, europe, and us multi-regions:

• IMAGE_TYPE/CONTEXT/VIOLENCE
• IMAGE_TYPE/CONTEXT/SEXUALLY_EXPLICIT
• IMAGE_TYPE/CONTEXT/SEXUALLY_SUGGESTIVE

For more information about all infoTypes, see InfoType detector reference.

General infoType functionality and the following infoTypes are now available in all regions:

• CREDIT_CARD_DATA
• DEMOGRAPHIC_DATA
• DRIVERS_LICENSE_NUMBER
• FINANCIAL_ID
• GEOGRAPHIC_DATA
• GOVERNMENT_ID
• MEDICAL_DATA
• MEDICAL_ID
• SECURITY_DATA
• TECHNICAL_ID

For more information about all built-in infoTypes, see the InfoType detector reference.

The OBJECT_TYPE/PERSON/FACE infoType detector is available in Preview in global and the asia, europe, and us multi-regions. For more information about all infoTypes, see InfoType detector reference.

The KOREA_NHI_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

The following infoType detectors are available in global and the europe and us multi-regions:

• DOCUMENT_TYPE/CONTEXT/FINANCE
• DOCUMENT_TYPE/CONTEXT/HEALTH
• DOCUMENT_TYPE/CONTEXT/LEGAL
• DOCUMENT_TYPE/CONTEXT/OBSCENE
• DOCUMENT_TYPE/CONTEXT/OFFENSIVE
• DOCUMENT_TYPE/CONTEXT/POLITICS
• DOCUMENT_TYPE/CONTEXT/RELIGION
• DOCUMENT_TYPE/CONTEXT/SEXUAL

For more information about all infoTypes, see InfoType detector reference.

The OBJECT_TYPE/PERSON/PASSPORT and OBJECT_TYPE/PERSON/PHOTO_ID_CARD infoType detectors are available in global and the asia, europe, and us multi-regions. For more information about all infoTypes, see InfoType detector reference.

The NEW_ZEALAND_DRIVERS_LICENSE_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

Customers with an organization-level activation of Security Command Center Premium have an organization-level discovery subscription at no charge from Sensitive Data Protection. For more information, see Sensitive data discovery in Security Command Center Premium.

The BRAZIL_RG_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

This is an addition to the May 1 release note announcing the deprecation of the ability to send inspection and discovery results from Sensitive Data Protection to Data Catalog.

If you have workflows that create inspection jobs or job triggers and set the deprecated PublishFindingsToCloudDataCatalog action, you must update those workflows by January 30, 2026. On or after this date, new jobs and job triggers that are created by those workflows will fail.

The DOCUMENT_TYPE/FINANCE/INVOICE and DOCUMENT_TYPE/MEDICAL/RECORD infoType detectors are available in global and the asia, europe, and us multi-regions. For more information about all infoTypes, see InfoType detector reference.

When you inspect a BigQuery table for sensitive data, you can send the inspection findings to Dataplex Universal Catalog. For more information, see Send inspection results to Dataplex Universal Catalog as aspects.

Fixed the issue preventing Sensitive Data Protection from detecting sensitive data in the headers and footers of certain rich document types.

When configuring schedules for Cloud Storage data discovery, you can select data based on specific tags. For more information, see Profile Cloud Storage data in an organization or folder or Profile Cloud Storage data in a single project.

The August 25 release note announcing the release of the DOCUMENT_TYPE/FINANCE/INVOICE and DOCUMENT_TYPE/MEDICAL/RECORD infoType detectors was published in error. These infotypes are not available.

The DOCUMENT_TYPE/FINANCE/INVOICE and DOCUMENT_TYPE/MEDICAL/RECORD infoType detectors are available in global and the asia, europe, and us multi-regions. For more information about all infoTypes, see InfoType detector reference.

The AUSTRIA_SOCIAL_SECURITY_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.

During discovery operations, Sensitive Data Protection scans the contents of various archive files. For a list of supported file types, see Supported file clusters in discovery operations.

You can configure Sensitive Data Protection to save the findings from an inspection job to a Cloud Storage bucket or folder. For more information, see Save findings to Cloud Storage.

Sensitive Data Protection provides recommendations to optimize your infoType selections. In the Google Cloud console, if you select a specific infoType that is covered by a general infoType, Sensitive Data Protection recommends general infoTypes that you can use instead.

For information about the benefits of using general infoTypes, see General and specific infoType detectors.

The following infoType detectors are available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

• DOCUMENT_TYPE/R&D/SOURCE_CODE/C
• DOCUMENT_TYPE/R&D/SOURCE_CODE/CPP
• DOCUMENT_TYPE/R&D/SOURCE_CODE/CS
• DOCUMENT_TYPE/R&D/SOURCE_CODE/GO
• DOCUMENT_TYPE/R&D/SOURCE_CODE/HTML
• DOCUMENT_TYPE/R&D/SOURCE_CODE/JAVA
• DOCUMENT_TYPE/R&D/SOURCE_CODE/JAVASCRIPT
• DOCUMENT_TYPE/R&D/SOURCE_CODE/JSON
• DOCUMENT_TYPE/R&D/SOURCE_CODE/PHP
• DOCUMENT_TYPE/R&D/SOURCE_CODE/POWERSHELL
• DOCUMENT_TYPE/R&D/SOURCE_CODE/PYTHON
• DOCUMENT_TYPE/R&D/SOURCE_CODE/RUST
• DOCUMENT_TYPE/R&D/SOURCE_CODE/SHELL
• DOCUMENT_TYPE/R&D/SOURCE_CODE/SQL
• DOCUMENT_TYPE/R&D/SOURCE_CODE/TYPESCRIPT

Sensitive Data Protection can detect and redact the following object infoTypes in images:

• OBJECT_TYPE/BARCODE
• OBJECT_TYPE/LICENSE_PLATE
• OBJECT_TYPE/PERSON
• OBJECT_TYPE/WHITEBOARD

For more information, see the following:

• Inspect an image for sensitive objects
• Object redaction

The CZECHIA_PERSONAL_ID_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The InfoType detector reference was updated to include the designated categories (locations, industries, and types) and default sensitivity score of each infoType.

Inspection jobs for XSLX files in Cloud Storage have improved performance. Sensitive Data Protection reads large custom dictionary source data only once for each sheet that has potential findings.

By default, scans for MAC_ADDRESS findings now include MAC_ADDRESS_LOCAL findings. Previously, you could only use this functionality if you set the InfoType.version of MAC_ADDRESS to latest in your InspectConfig.

You can still use the old version of MAC_ADDRESS by setting its InfoType.version to legacy or by using the MAC_ADDRESS_UNIVERSAL infoType. In 90 days, the new functionality will be promoted to legacy.

On or after September 30, 2025, you can no longer send inspection and discovery results from Sensitive Data Protection to Data Catalog. Data Catalog is deprecated and will be discontinued on January 30, 2026. For Sensitive Data Protection, no action is required from you. No inspection or discovery configuration will break.

For discovery operations, we recommend that you add Dataplex Catalog aspects based on insights from data profiles instead.

You can automatically attach aspects to Dataplex entries after profiling supported data resources. For more information, see Add Dataplex Catalog aspects based on insights from data profiles.

The discovery service of Sensitive Data Protection now supports Azure Blob Storage. You can run discovery to generate data profiles of your Blob Storage containers. Data profiles provide metrics and insights about the sensitivity and risk levels of your data to help you plan your data protection and governance workflows.

This feature is available only to Security Command Center Enterprise customers. To use this feature, you need an Azure connector in Security Command Center that has permissions for Sensitive Data Protection discovery.

To get started on profiling Blob Storage data, see the following:

• Connect to Microsoft Azure for configuration and resource data collection
• Profile Azure Blob Storage data

The discovery findings that Sensitive Data Protection generates in Security Command Center include recommended next steps. This improvement applies to the finding categories listed in Publish data profiles to Security Command Center.

If you set InfoType.version to latest when including the MAC_ADDRESS infoType in your InspectConfig, Sensitive Data Protection will now include MAC_ADDRESS_LOCAL findings as type MAC_ADDRESS in the scan results.

You can still use the old functionality by setting InfoType.version to stable, by leaving InfoType.version unset when using the MAC_ADDRESS infoType, or by using the MAC_ADDRESS_UNIVERSAL infoType. In 30 days, the new functionality will be promoted to stable.

The MAC_ADDRESS_UNIVERSAL infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The CZECHIA_PASSPORT infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Sensitive Data Protection is available in the europe-north2 region. For more information, see Sensitive Data Protection locations.

Data profiles that send findings to Security Command Center include the INFO_TYPES and RELATED_RESOURCES fields when available. These fields appear in the sourceProperties field of the finding in Security Command Center. The affected finding categories are DATA_RISK, DATA_SENSITIVITY, PUBLIC_SENSITIVE_DATA, SECRETS_IN_STORAGE, and SENSITIVE_DATA_CMEK_DISABLED.

Sensitive data discovery for Vertex AI is in General Availability. You can run discovery at the organization, folder, or project level to generate profiles of your Vertex AI training data. Data profiles provide metrics and insights about the sensitivity and risk levels of your data to help you plan your data governance workflows.

The JAPAN_CORPORATE_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The RELIGIOUS_TERM infoType detector is now generally available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The CREDIT_CARD_EXPIRATION_DATE infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Regional endpoints for Sensitive Data Protection are available in the eu and us multi-regions. For more information, see Global and regional endpoints for Sensitive Data Protection.

The CVV_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The TAIWAN_ID_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The FRANCE_DRIVERS_LICENSE_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

The current default DATE_OF_BIRTH infoType detection model, which is available when InfoType.version is set to latest or stable, is now also used when InfoType.version is set to legacy.

The old detection model that was previously available by setting InfoType.version to legacy is no longer available.

The PHONE_NUMBER infoType functionality that was previously only available by setting InfoType.version to latest or stable is now also used when InfoType.version is set to legacy. The new model includes US_TOLLFREE_PHONE_NUMBER findings as type PHONE_NUMBER in the scan results.