Data Access versus Protect
Important To prevent policy drift and inconsistent security, do not manage the same data sources with Data Access and Protect at the same time. When you are ready to adopt the advanced governance capabilities of Data Access, plan a complete migration of your Protect-managed data sources.
Both Data Access and Protect help you govern sensitive data, but they differ significantly in scope and approach.
Data Access operates at the identity level to directly grant and revoke access to data. You manage access for users across all your data sources simultaneously. Protect, by contrast, operates at the data level. Rather than managing the underlying access itself, Protect applies only column masking and row filtering policies on top of a user's existing access. You classify columns, assign them to data categories, and apply protections that follow the logical data model in Collibra.
| Aspect | Data Access | Protect |
|---|---|---|
| Concept |
Defines who gets access and what they can access by assigning access controls to identities or groups, either explicitly or dynamically. |
Defines who gets access and what they can access by associating Protect groups with logical assets that map to the underlying physical data. |
| Purpose |
Provides centralized access provisioning and secure, self-service data democratization. Data Access focuses on connecting the right users to the right data faster, centralizing access controls, and maintaining a clear audit trail. |
Enforces privacy and compliance. Protect focuses on securing sensitive information to minimize risk and ensure compliance. |
| Approach (what) |
Bridges the logical and physical data layers. You build policies directly against physical data objects, such as databases, tables, and columns, or use imported native system tags to dynamically grant access based on tags, for example |
Uses a logical and contextual approach. You build policies against logical business assets in your Collibra Data Catalog, such as data classifications, data categories, and business processes, which Protect then maps to the underlying physical columns. |
| Approach (who) |
Governs the unified identity. Data Access creates a unified profile that links a user to all their source accounts. |
Governs the group. Protect uses Protect groups that map directly to native technical roles or principals in the target data sources. |
| Typical use case |
A data owner managing time-bound access requests for a Customer Data Product, while a data steward ensures that PII within that product remains dynamically masked unless the user belongs to a specific approved department. |
A data steward creating a policy that masks anything that is classified as PII across platforms, with a specific rule to unmask it only for the HR group. |
| Sync |
Both inbound and outbound. Data Access pulls existing entities from your data sources and pushes Collibra-managed access controls to your data sources. |
Outbound only. Protect pushes Collibra-defined standards and rules to your data sources. |