snowflake-data-handling

# Snowflake Data Handling ## Overview Implement data governance in Snowflake using column-level masking policies, row access policies, object tagging, and data classification for GDPR/CCPA compliance. ## Prerequisites - Enterprise Edition or higher (for masking and row access policies) - SECURITYADMIN or ACCOUNTADMIN role - Understanding of GDPR/CCPA data subject rights ## Instructions ### Step 1: Data Classification with Tags ```sql -- Create tag taxonomy CREATE TAG IF NOT EXISTS pii_type ALLOWED_VALUES 'email', 'phone', 'ssn', 'name', 'address'; CREATE TAG IF NOT EXISTS data_sensitivity ALLOWED_VALUES 'public', 'internal', 'confidential', 'restricted'; -- Apply tags to columns ALTER TABLE users MODIFY COLUMN email SET TAG pii_type = 'email'; ALTER TABLE users MODIFY COLUMN phone SET TAG pii_type = 'phone'; ALTER TABLE users MODIFY COLUMN name SET TAG pii_type = 'name'; ALTER TABLE users MODIFY COLUMN email SET TAG data_sensitivity = 'confidential'; -- Find all tagged columns SELECT * FROM TABLE(INFORMATION_SCHEMA.TAG_REFERENCES( 'users', 'TABLE' )); -- Discover PII with Snowflake's automatic classification (Enterprise+) SELECT * FROM TABLE( INFORMATION_SCHEMA.EXTRACT_SEMANTIC_CATEGORIES('users') ); ``` ### Step 2: Column-Level Masking Policies ```sql -- Dynamic masking — shows real data to privileged roles, masked to others CREATE OR REPLACE MASKING POLICY email_mask AS (val STRING) RETURNS STRING -> CASE WHEN CURRENT_ROLE() IN ('DATA_ENGINEER',...