Oracle Data Redaction and Oracle Virtual Private Database

Oracle Data Redaction does not affect Oracle Virtual Private Database policies because the VPD inline view, which contains the VPD predicate, acts on actual values. VPD column masking and data redaction policy can be applied on the same columns. VPD column masking is applied first and then the data is redacted.

The main difference between Data Redaction and VPD is that VPD is an access control technology while Data Redaction is used to limit data exposure. You shouldn’t use Data Redaction as an access control solution.

Additionally, Oracle Data Redaction differs from Oracle Virtual Private Database in the following ways:

• Oracle Data Redaction provides more redaction features than Oracle Virtual Private Database column masking, which only displays NULL for sensitive columns. Many applications cannot support NULL values, so Oracle Data Redaction is a good solution for these applications.

• Oracle VPD can provide column and row masking. Data Redaction only affects how the columns’ values are displayed, not the rows returned.

• Oracle Virtual Private Database policies can be static, dynamic, and context sensitive, whereas Oracle Data Redaction policies only allow static and context-sensitive policy expressions.

• Oracle Data Redaction permits only one policy to be defined on a table or view, whereas you can define multiple Virtual Private Database policies on an object.

• Data Redaction does not support policies on synonyms, while Oracle VPD does.

Related Topics

• Using Oracle Virtual Private Database to Control Data Access in the Oracle AI Database Security Guide