Masking

Goal

Tag-based masking is the Snowflake-native way to protect personal data in accordance with GDPR. Columns that have received a PII tag are automatically masked when queried by roles without access. The underlying data remains unchanged; only the display differs per role.

What to expect

The setup creates six tag types in the datamodder schema, each with a matching masking policy. By default only SYSADMIN sees the actual values; this is configurable.

Usage

1. Run one-time setup

First run setup.sql as accountadmin, then create_masking_setup:

{{ create_masking_setup() }}

The macro is idempotent (safe to run multiple times, uses IF NOT EXISTS).

2. Apply tag to a column

Use apply_masking_tag to attach a tag to a column:

{{ apply_masking_tag(
    database = 'MY_DB',
    schema   = 'MY_SCHEMA',
    table    = 'CUSTOMERS',
    column   = 'EMAIL',
    tag      = 'pii_email'
) }}

3. Adjust access role (optional)

Set which role may see unmasked data via project variables:

vars:
  masking_config:
    unmasked_role: SYSADMIN