Data Governance in Practice — GDPR, Data Classification, and Access Control

As data volumes grow, so does responsibility. Who has access to what data? Where is personal data stored? How long do we retain it? Data governance provides the answers.

Data Classification¶

• Public — publicly available (blog, marketing)
• Internal — company-wide, not for public consumption
• Confidential — trade secrets, client data
• Restricted — personal data, financial data, health records

Every dataset in Snowflake has a data_classification tag. Automated PII detection (name, national ID, email) via Azure Purview.

GDPR Compliance¶

Right to erasure: we must be able to delete all data about a specific individual across systems. We implemented “data lineage” — we know where personal data flows. Retention policies: automatic anonymization after the retention period expires.

Access Management¶

Role-based access in Snowflake. Analysts see aggregated data, not raw PII. Data scientists access anonymized datasets. Full access only for data stewards with an audit log.

Governance ≠ Bureaucracy¶

Automated governance protects both the company and its customers. PII detection, retention policies, and access control — all automated.