Stop 13 · Version Control, Git & CollaborationTopics · 7/7

Data Governance & Privacy Basics

In short

Analysts often have access to names, phone numbers and payment details of thousands of people. Handling that carefully is part of the job, and laws in many countries, including India, now require it.

Understanding access controls, PII (personally identifiable information) handling, and basic compliance concepts — increasingly a real expectation even for junior analyst roles.

The jaadu holds a big brass key in a room lined with rows of metal lockers.

Think of it like this

The bank locker room

In a bank's locker room, only you and the manager hold keys to your locker. Every visit is noted in a register. Nobody can just wander in and open boxes. Good data governance treats personal data the same way: limited keys, logged access.

Watch it happen

Classifying data by sensitivity

Company data

Public

Internal

Confidential

Restricted

Phone, email

Payment, ID

1/4Not all data is equally sensitive. Most companies sort it into a few levels.

The big ideas

What you need to know

Least access

Get access only to the data your task needs. You rarely need real names or phone numbers to analyse trends.

Mask or hash personal data

Replace emails and phones with hashed IDs in analysis tables. You can still count and join without seeing them.

Laws set the rules

India's Digital Personal Data Protection Act, 2023 and Europe's GDPR govern personal data. Your company's policy tells you how they apply.

Think before you share

Never paste customer lists into personal email, public AI tools or unapproved apps.

See it in code

Walk through the code

sql

1CREATE VIEW analytics.customers_safe AS2SELECT3  customer_id,4  TO_HEX(SHA256(LOWER(email))) AS email_hash,5  city,6  DATE_TRUNC(signup_date, MONTH) AS signup_month7FROM raw.customers;

1/3Analysts get access to this view, not to raw.customers.

A BigQuery view that analysts can use instead of the raw table. Personal fields are hashed, dropped or made less precise.

Save yourself the pain

Common mistakes

Oops

Exporting a full customer list with phone numbers to a CSV on your laptop for a quick analysis.

Do this instead

Work inside the approved warehouse with masked data. Export only aggregated results if needed.

Oops

Sharing a dashboard publicly because "it's just counts", while it shows small groups you can identify.

Do this instead

Check sharing settings and hide groups so small that individuals could be spotted.

Your mission

Mask a sample dataset

~25 min

Quick check

You need to count unique customers per city. Which data do you actually need?

Go deeper

1Learn what counts as PII and why it needs special handling in any analysis.
2Understand basic access-control concepts: who should see raw data versus aggregated data.
3Read a short overview of a relevant privacy regulation for your target market (e.g. GDPR, DPDP).