Data Masking on Databricks

Only ALTR tag-based masking is supported on Databricks. Databricks natively supports column-level masks; ALTR enforces a masking policy by writing a native Unity Catalog column mask directly to your workspace for every column carrying the tag the policy targets. For the equivalent mechanism on Snowflake, see Data Masking on Snowflake.

Prerequisites

Before creating a masking policy, connect the tag you want to mask by — see Preparing Your Databricks Account for the account-level setup this depends on.

Pushdown-Only Masking

ALTR enforces masking on Databricks entirely through Unity Catalog: ALTR writes the masking rule as a native Unity Catalog column mask, and Databricks evaluates it locally, with no call back to ALTR at query time. Databricks masking policies cannot make external network calls, so ALTR’s masking mechanism on Databricks has no equivalent to Snowflake’s external-function connection option — Databricks masking is pushdown only.

Because there is no external-function invocation, detokenization and Format-Preserving Encryption (FPE) decryption — both of which require ALTR to make a network call at query time — are not available on Databricks. Contact ALTR support about tokenization or FPE on Databricks.

Databricks supports a subset of the masking types available on Snowflake.

Masking by Tag Name or Tag Value

When you create a tag-based policy, you choose how the tag is matched:

• Tag name applies one masking rule to every column that carries the tag, whatever its value. Use this for broad, tag-level policies — for example, masking every column tagged as salary data and granting access only to the chief financial officer.
• Tag name and value applies masking per specific tag value, so a single tag can carry different rules for different values. Use this for more granular policies — for example, masking columns tagged pii=ssn for everyone except HR while leaving columns tagged pii=phone unmasked.

Tag values are matched exactly.

Create a Tag-Based Masking Policy

To create a tag-based masking policy on Databricks:

1. Select Policy in the navigation menu.
2. Click Create Policy.
3. Locate the Tag Policy card and click Create Policy.
4. Click Create Policy for Databricks.
5. Enter the Tag Name the policy affects. The policy applies its masking rules to every column assigned this tag.
6. Select the Metastore where the tag is located.
7. Click Next.
8. Build the rule statement:
   1. Select the Role the rule applies to. On Databricks, this is a Databricks account group.
   2. Choose Tag name or Tag name and value to set how the masking rule is matched.
   3. Select the Masking Type applied to query results for that role.
9. (Optional) Click + Rule Statement to add more rules to the policy.
10. (Optional) Disable Policy State to save the policy inactive and activate it later. You can activate or deactivate a policy at any time; deactivating it stops applying its rules to your data.
11. Click Save. ALTR deploys the policy as a native Unity Catalog column mask on every column carrying the matching tag.

Overlapping Policies

When more than one policy applies to the same column for a role, ALTR applies the most permissive masking type among them.

For example, if one policy grants the DataStewards group No Mask on the PII tag and does not include the AllUsers group, users in AllUsers see the column’s default masked value. If a second policy then grants AllUsers a less restrictive masking type on the same tag, those users see that value instead, because the most permissive applicable policy determines what each group sees.

Delete a Tag-Based Masking Policy

Deleting a tag-based masking policy removes its masking rules, so the affected columns are no longer masked for the roles and tag values it covered. This removes the policy from ALTR only — it does not remove the tag from Databricks.

To delete a tag-based masking policy:

1. Select Policy in the navigation menu.
2. Expand the policy you want to delete.
3. Click Edit Policy.
4. Click Delete Policy. ALTR displays a confirmation modal.
5. Click Delete Policy to confirm.

Force Delete a Tag-Based Masking Policy

Danger

Before force deleting a policy, contact ALTR Support. Force deleting a policy can affect your source system if you don’t fully understand your data and this feature.

Force delete removes a tag-based masking policy from ALTR even if it can’t be removed from Databricks. Use it only as a last resort; it’s available for any tag-based masking policy.

To force delete a policy:

1. Select Policy in the navigation menu.
2. Click the policy you want to delete.
3. Click Edit Policy.
4. Click Trouble deleting?.
5. Click Force Delete Policy.
6. Review your source system and clean up any objects the policy left behind.