De-Identification for Structured Data

Overview

Netskope Data Security Posture Management (DSPM) provides data de-identification (DID) capabilities to remediate sensitive data across your organization’s relational databases. De-identification transforms sensitive fields, such as Personally Identifiable Information (PII) and Protected Health Information (PHI), using defined masking, hashing, or redaction rules while preserving structural data validity.

For structured relational databases, Netskope DSPM evaluates connected schemas, identifies sensitive fields using Sensitive Data Types (SDTs) or Entity Data Types (EDTs), and applies remediation queries directly at rest.

If you want to de-identify tabular files or file shares instead of relational databases:

• To learn more: De-Identification for Semi-Structured / Unstructured Data.

Supported Databases

Netskope DSPM supports de-identification for the following relational database systems:

Prerequisites and Permissions

Before you enable de-identification on a structured data store, verify the following configuration requirements:

• Service Account Privileges: Standard DSPM discovery and classification require read-only (SELECT) permissions. To execute de-identification remediation, the database user account configured in DSPM requires explicit write privileges (UPDATE) on target schemas and tables:
  • Microsoft SQL Server: GRANT UPDATE ON SCHEMA::<schema_name> TO <dspm_user>;
  • Oracle: GRANT UPDATE ON <schema_name>.<table_name> TO <dspm_user>;
• Administrator Roles: De-identification does not require a dedicated administrator role. To view and manage de-identification workflows, you need the standard Security Posture > Data > Management or Security Posture > Data > Administration permission to access Classification Management.
• Feature Activation: De-identification is a licensed feature controlled by a tenant entitlement flag. Contact your Netskope representative if this capability does not appear in your tenant.
• Scanning Behavior: De-identification queries run automatically during your standard scheduled or on-demand data store scans. The system does not require a separate scan schedule.

To learn more about connecting data stores and managing administrator roles:

• To learn more: Connect SQL Server to DSPM
• To learn more: Manage DSPM Administrator Permissions (RBAC)

Prerequisites and Permissions

Before you enable de-identification on a structured data store, verify the following configuration requirements:

• Service Account Privileges: Standard DSPM discovery and classification require read-only (SELECT) permissions. To execute de-identification remediation, the database user account configured in DSPM requires explicit write privileges (UPDATE) on the target schemas and tables. For database connection details:
  • To learn more: Connect SQL Server to DSPM
• Administrator Roles: Managing de-identification workflows requires access to Classification Management. Ensure your administrator account has the standard Security Posture > Data > Management or Security Posture > Data > Administration permission. For role configuration details:
  • To learn more: Manage DSPM Administrator Permissions (RBAC)
• Feature Activation: De-identification is a licensed feature controlled by a tenant entitlement flag. Contact your Netskope representative if this capability does not appear in your tenant.
• Scanning Behavior: De-identification queries run automatically during your standard scheduled or on-demand data store scans. The system does not require a separate scan schedule.

Enabling De-Identification on a Data Store

To enable de-identification workflows on a structured database:

1. In the Netskope One platform, go to Settings > DSPM > Data Stores > Data Store Inventory.
2. Select your data store configuration path:
   • To configure an existing connection, locate your database instance (Oracle or Microsoft SQL Server) in the list and click Edit.
   • To configure a new connection, click Add Data Store and choose your database service.
3. Click the Capabilities tab.
4. Select the Remediate De-Identification Violations checkbox.
5. Click Save.

Enrolling Columns for De-Identification

De-identification operates on an explicit opt-in basis per column. Because de-identification modifies database records at rest, this opt-in model ensures you validate your transformation rules before execution. Connected databases remain unmodified until you explicitly enroll specific columns.

To enroll columns from Classification Management:

1. In the Netskope One platform, go to DSPM > Classification > Classification Management.
2. Click the Columns tab.
3. Use the filters to select your database data store, schema, table, or sensitive data type.
4. Review the columns associated with your database:
   • Data Store: The name of the connected database instance.
   • Table: The database table containing the column.
   • Column: The detected tabular field name.
   • Data Type: The identified entity data type or sensitive data type (such as US SSN, Email, or Credit Card Number). Click the rule name to inspect the assigned transformation logic.
   • De-Id Violations: The number of records matching the sensitive data type that require remediation.
5. Select the fields you want to remediate:
   • To enroll individual fields, select the checkbox in the Enable De-Identification column next to each target column.
   • To enroll all visible fields at once:
     • Select the bulk-selection checkbox in the table header.
     • Choose the bulk-remediation action that appears above the table to enable de-identification across the selected columns.
6. Click Save.

Executing Remediation and Preserving Data Integrity

When a scheduled or manual scan runs on an enrolled database, the DSPM engine applies remediation directly to the database tables:

• Direct Transformation at Rest: The system executes targeted remediation queries against enrolled columns to obfuscate sensitive values according to configured rules (such as synthetic identifier generation, date truncation, or phone masking).
• Referential Integrity: When remediating columns linked by primary key and foreign key constraints, ensure you enroll all related columns and use deterministic masking rules to maintain key consistency across tables.
• Transaction Safety: If the database encounters a query execution failure or constraint conflict during processing, the transaction rolls back, leaving unmodified rows intact.

Monitoring De-Identification Results

To review remediation progress and verify that sensitive data counts decrease:

1. In the Netskope One platform, go to DSPM > Classification > Classification Management.
2. Click the Columns tab.
3. Verify that the De-Id Violations counter displays zero (0) for fully remediated columns.
4. Expand any column row in the table to review specific execution status and error logs.
5. (Optional) To email a scan results report from the Classification Management screen:
   • In the toolbar click email report > Enter the destination email addresses > Click Save.
6. Go to Settings > DSPM > Activity Log to view administrative audit records, including when administrators enabled de-identification, enrolled columns, and ran scan jobs.