Snowflake Data Classification

Organizations store thousands of columns, and nobody remembers which ones hold names, emails, or national ID numbers. Data classification scans table columns, recognizes personal and sensitive data, and labels it with tags. Teams protect labeled columns with masking policies and report on them for audits.

The Mail Sorting Comparison

A post office sorts letters by looking at addresses. Workers do not read the letter inside; the envelope tells them where it goes. Classification inspects column names and sample values and decides what kind of data lives in each column. A column with values that look like email addresses gets an email label, and a column with phone-like numbers gets a phone label.

CLASSIFICATION FLOW
===================

 +----------------+     +------------------+     +--------------------+
 | Table columns  |---->| Classification   |---->| System tags added  |
 | name, email,   |     | scans samples    |     | SEMANTIC_CATEGORY  |
 | city, amount   |     | and column names |     | PRIVACY_CATEGORY   |
 +----------------+     +------------------+     +---------+----------+
                                                            |
                                                            v
                                               Tag-based masking policies
                                               protect labeled columns

Two Kinds of Labels

  • Semantic category: what the data means, such as NAME, EMAIL, PHONE_NUMBER, or DATE_OF_BIRTH.
  • Privacy category: how risky the data is. IDENTIFIER points to a person directly, QUASI_IDENTIFIER can identify someone when combined with other columns, and SENSITIVE covers private facts such as salary or health details.

Running Classification

-- Preview the results without changing anything
SELECT EXTRACT_SEMANTIC_CATEGORIES('sales_db.public.customers');

-- Classify and apply system tags automatically
CALL SYSTEM$CLASSIFY('sales_db.public.customers', {'auto_tag': true});

The preview returns a JSON document with each column, its likely category, and a confidence level. The second call writes the tags onto the columns. Reviewers should read the preview first, since automatic detection occasionally mislabels columns with unusual formats.

Reading the Tags

SELECT column_name, tag_name, tag_value
FROM TABLE(INFORMATION_SCHEMA.TAG_REFERENCES_ALL_COLUMNS(
  'sales_db.public.customers', 'table'))
WHERE tag_name IN ('SEMANTIC_CATEGORY', 'PRIVACY_CATEGORY');
SAMPLE RESULT
=============
column_name   SEMANTIC_CATEGORY   PRIVACY_CATEGORY
-----------   -----------------   ----------------
full_name     NAME                IDENTIFIER
email         EMAIL               IDENTIFIER
zip_code      US_POSTAL_CODE      QUASI_IDENTIFIER
salary        SALARY              SENSITIVE
order_total   (none)              (none)

Protecting Classified Columns

Tags become powerful when a policy follows them. A masking policy attached to the privacy tag hides every IDENTIFIER column from ordinary roles.

CREATE MASKING POLICY governance.policies.mask_identifier AS (val STRING)
RETURNS STRING ->
  CASE WHEN CURRENT_ROLE() IN ('PRIVACY_ADMIN') THEN val
       ELSE '*** HIDDEN ***' END;

ALTER TAG SNOWFLAKE.CORE.PRIVACY_CATEGORY
  SET MASKING POLICY governance.policies.mask_identifier;

Administrators confirm their account allows tag-level policies on system tags, and they test with a non-privileged role before relying on the setup.

Automating at Scale

Manual calls suit a handful of tables. Large accounts use classification profiles that scan whole schemas or databases on a schedule and tag new tables as they appear. A profile sets the target schedule, the minimum confidence, and whether tags apply automatically or wait for review. New data enters the warehouse already labeled.

Good Practices

  • Classify raw landing tables first, since sensitive data enters there.
  • Review preview results before auto-tagging, and correct mistakes with manual tags.
  • Record a data owner for every table that contains personal data.
  • Combine classification with masking, row access policies, and access history.
  • Rerun classification after major schema changes.

A Practical Scenario

A company prepares for a privacy audit and cannot list where customer emails live. A governance analyst runs classification across the customer database and receives a list of 41 email columns in 19 tables. Masking policies attach to the privacy tag the same afternoon. The audit report shows each column, its label, and the policy protecting it.

Frequently Asked Questions

Does classification change my data?

Classification reads sample values and writes tags. The data itself stays unchanged.

Review Routine

Assign a data steward to read each classification report. The steward confirms correct labels, fixes wrong ones with manual tags, and records exceptions with a short reason. A quarterly review keeps labels accurate as columns change.

Key Points

  • Classification detects personal and sensitive data in columns.
  • Semantic and privacy categories label what data means and how risky it is.
  • EXTRACT_SEMANTIC_CATEGORIES previews; SYSTEM$CLASSIFY with auto_tag applies tags.
  • Tag-based masking policies protect labeled columns automatically.
  • Scheduled profiles keep new tables labeled without manual work.
  • The feature needs Enterprise Edition or higher.
Previous lesson
Back to course
Next lesson