Cloud Data Loss Prevention (Cloud DLP) is now a part of Sensitive Data Protection. The API name remains the same: Cloud Data Loss Prevention API (DLP API). For information about the services that make up Sensitive Data Protection, see
Sensitive Data Protection overview .
Send feedback
Regulatory support in Sensitive Data Protection
Stay organized with collections
Save and categorize content based on your preferences.
This document describes the features, configurations and APIs in Sensitive Data Protection that align
with the controls for supported control packages. This document assumes that
you're using Assured Workloads .
Show All
Data Boundary for ITAR
Supported services
The following table lists the Sensitive Data Protection APIs and versions that meet the requirements of Data Boundary for ITAR.
Service
Version
Status
dlp.googleapis.com
v2
SUPPORTED
Compliance supported regions
Sensitive Data Protection is available for Data Boundary for ITAR in the following Google Cloud regions:
us-central1
us-central2
us-east1
us-east4
us-east5
us-south1
us-west1
us-west2
us-west3
us-west4
API fields for sensitive data
Resource: No resource
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/ColumnDataProfile
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/columnDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListColumnDataProfiles
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/columnDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListColumnDataProfiles
Resource: dlp.googleapis.com/Connection
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/connections
RPC methods:
google.privacy.dlp.v2.DlpService.ListConnections
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/connections:search
RPC methods:
google.privacy.dlp.v2.DlpService.SearchConnections
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/connections
RPC methods:
google.privacy.dlp.v2.DlpService.ListConnections
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/connections:search
RPC methods:
google.privacy.dlp.v2.DlpService.SearchConnections
Resource: dlp.googleapis.com/ContentPolicy
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/DeidentifyTemplate
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/DiscoveryConfig
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/DlpJob
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/Estimate
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: POST /v2/{parent=organizations/*/locations/*}/estimates
RPC methods:
google.privacy.dlp.v2.DlpService.CreateEstimate
dataProfileConfig.schedules.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagKeydataProfileConfig.schedules.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagValuedataProfileConfig.targets.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagKeydataProfileConfig.targets.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagValue
Service: dlp.googleapis.com
REST API: POST /v2/{parent=projects/*/locations/*}/estimates
RPC methods:
google.privacy.dlp.v2.DlpService.CreateEstimate
dataProfileConfig.schedules.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagKeydataProfileConfig.schedules.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagValuedataProfileConfig.targets.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagKeydataProfileConfig.targets.cloudStorageTarget.filter.collection.includeTags.tagFilters.namespacedTagValue
Resource: dlp.googleapis.com/FileStoreDataProfile
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/fileStoreDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListFileStoreDataProfiles
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/fileStoreDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListFileStoreDataProfiles
Service: dlp.googleapis.com
REST API: POST /v2/{parent=organizations/*/locations/*}/fileStoreDataProfiles:startHybridDataProfile
RPC methods:
google.privacy.dlp.v2.DlpService.StartFileStoreHybridDataProfile
profileIdtags.keytags.namespacedTagValuetags.value
Service: dlp.googleapis.com
REST API: POST /v2/{parent=projects/*/locations/*}/fileStoreDataProfiles:startHybridDataProfile
RPC methods:
google.privacy.dlp.v2.DlpService.StartFileStoreHybridDataProfile
profileIdtags.keytags.namespacedTagValuetags.value
Resource: dlp.googleapis.com/Finding
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/findings
RPC methods:
google.privacy.dlp.v2.DlpService.ListFindings
Resource: dlp.googleapis.com/InspectTemplate
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/JobTrigger
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
Resource: dlp.googleapis.com/ProjectDataProfile
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/projectDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListProjectDataProfiles
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/projectDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListProjectDataProfiles
Resource: dlp.googleapis.com/StoredInfoType
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.ListStoredInfoTypes
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.ListStoredInfoTypes
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.ListStoredInfoTypes
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.ListStoredInfoTypes
Service: dlp.googleapis.com
REST API: PATCH /v2/{name=organizations/*/locations/*/storedInfoTypes/*}
RPC methods:
google.privacy.dlp.v2.DlpService.UpdateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.path
Service: dlp.googleapis.com
REST API: PATCH /v2/{name=organizations/*/storedInfoTypes/*}
RPC methods:
google.privacy.dlp.v2.DlpService.UpdateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.path
Service: dlp.googleapis.com
REST API: PATCH /v2/{name=projects/*/locations/*/storedInfoTypes/*}
RPC methods:
google.privacy.dlp.v2.DlpService.UpdateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.path
Service: dlp.googleapis.com
REST API: PATCH /v2/{name=projects/*/storedInfoTypes/*}
RPC methods:
google.privacy.dlp.v2.DlpService.UpdateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.path
Service: dlp.googleapis.com
REST API: POST /v2/{parent=organizations/*/locations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.CreateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.pathstoredInfoTypeId
Service: dlp.googleapis.com
REST API: POST /v2/{parent=organizations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.CreateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.pathstoredInfoTypeId
Service: dlp.googleapis.com
REST API: POST /v2/{parent=projects/*/locations/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.CreateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.pathstoredInfoTypeId
Service: dlp.googleapis.com
REST API: POST /v2/{parent=projects/*}/storedInfoTypes
RPC methods:
google.privacy.dlp.v2.DlpService.CreateStoredInfoType
config.dictionary.bigQueryColumn.field.nameconfig.dictionary.cloudStoragePath.pathconfig.largeCustomDictionary.bigQueryField.field.nameconfig.largeCustomDictionary.cloudStorageFileSet.urlconfig.largeCustomDictionary.outputPath.pathstoredInfoTypeId
Resource: dlp.googleapis.com/TableDataProfile
The following table specifies the API resources and fields that are designed to handle data that is protected under Data Boundary for ITAR.
API Method
Protected fields
Service: dlp.googleapis.com
REST API: GET /v2/{parent=organizations/*/locations/*}/tableDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListTableDataProfiles
Service: dlp.googleapis.com
REST API: GET /v2/{parent=projects/*/locations/*}/tableDataProfiles
RPC methods:
google.privacy.dlp.v2.DlpService.ListTableDataProfiles
Fields not intended for Sensitive data
The following table provides an illustrative list of field categories and specific fields that aren't suitable for sensitive information. To maintain compliance, avoid placing protected data in these fields. For a complete list, contact your Google Cloud representative.
Category
Fields
Deidentification configuration
deidentifyConfig.recordTransformations.fieldTransformations.primitiveTransformation.dateShiftConfig.cryptoKey.transient.name
Field transformation rules
deidentifyConfig.recordTransformations.fieldTransformations.condition.expressions.conditions.conditions.field.name
Filtering and ordering
General identifiers
subscription.billingAccountNamesubscription.dataProfileCapacity.projectId
KMS encryption keys
deidentifyConfig.recordTransformations.fieldTransformations.primitiveTransformation.dateShiftConfig.cryptoKey.kmsWrapped.cryptoKeyName
Resource identification
locationIdnameparentprojectIdtemplateId
What's next
Send feedback
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License , and code samples are licensed under the Apache 2.0 License . For details, see the Google Developers Site Policies . Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-10-15 UTC.
Need to tell us more?
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-10-15 UTC."],[],[]]
