Google BigQuery DSR integration

Missing an action you need, or an integration we don't support yet? Contact your Customer Success Manager.

This integration automates privacy requests for Google BigQuery. MineOS runs the queries you write, using the requester's email address, to preview, delete or copy the rows that belong to them.

To scan BigQuery for personal data, see Google BigQuery data classification integration.

How It Works

• Preview: before MineOS deletes or copies anything, it runs your Preview query and shows you the rows it returns for the requester (up to three text, number or true/false columns per row).
• Delete: MineOS runs your Delete query for the requester. If you also set a Preview query, MineOS runs it again afterwards to confirm that no rows remain.
• Get a copy: MineOS runs your Copy query and sends the requester the rows it returns. If the query returns no rows, the task is reported as not found.

Choose the right integration type

The Big Query Views types are for data classification only. See the classification article linked above.

Before You Start

• Make sure you have access to Google Cloud Platform and Google BigQuery, and know the Project ID you want to use.
• The connecting user or service account must be able to run queries and to read and delete data in the tables your queries use. The BigQuery Admin role covers this. The BigQuery Data Viewer and BigQuery Job User roles on their own are enough for previews and copies, but not for deletions.
• If your organization enforces a session timeout for Google Cloud scopes, mark the MineOS app as trusted and exempt trusted apps from session timeout. Otherwise the integration expires and has to be reconnected.
• MineOS requests the https://www.googleapis.com/auth/bigquery scope when you connect with OAuth.

Setting Up

Step 1: Prepare your queries

Write the queries MineOS should run, and test them in BigQuery first. Use {{endUserEmail}} wherever the requester's email address belongs. MineOS passes the email address as a query parameter, so don't put quotes around the placeholder. You enter the queries in the integration setup, after the Project ID in the connection steps below.

Fill in only the queries for the actions you want to handle. The Delete query is required for deletion requests, the Copy query for get a copy requests, and the Preview query for previews.

Step 2: Connect in MineOS

1. Log in to MineOS. On the left sidebar, click Inventory → Add data source, search for Google BigQuery and add it. If it's already in your inventory, skip this step.

2. Open the Google BigQuery system and go to the DSR & integrations tab. If an integration instance already exists, click Add instance.

3. Under Action for fulfilling requests, select Integration.

4. In the Integration Type dropdown, choose your connection type, then follow the Set up integration wizard.

5. Connect your account:

   • OAuth types: click Connect and follow the on-screen instructions to grant the required permissions.
   • Service account types:
     a. In the Google Cloud Console, open IAM & Admin and choose your organization or project from the top bar.
     b. On the IAM page, click Grant access.
     c. Copy the principal account shown in MineOS and paste it into New principals.
     d. Assign the roles listed in Before You Start, then save.

6. Enter your Google Cloud Project ID.

7. Enter the queries you prepared in Step 1, then click Finish. MineOS tests the connection before saving it.

You're done! MineOS has been connected to your BigQuery project.

Using the Integration in Requests

To handle requests automatically, add the BigQuery integration to the workflows of the privacy rights it should handle, such as deletion or get a copy.

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!