Table of Contents
TL;DR
Fintech and healthtech teams face constant audit pressure, and Unity Catalog gives them the tools to handle it: unified access control, lineage, and classification across data and AI assets. But the tool alone doesn’t decide who owns what data or how it should be classified, that requires a governance model built around real regulatory obligations like PCI DSS, HIPAA, and SOX. Getting this right means defining data domains and owners, setting a consistent classification scheme, standardizing access patterns by role, and building lineage-backed audit trails that turn compliance from a manual scramble into a repeatable process.
Executive Summary
Fintech and healthtech live under constant regulatory scrutiny. Every query, join, and export can become an audit question. Unity Catalog now sits at the core of Databricks’ Data Intelligence Platform, offering unified access control, lineage, discovery, and intelligent policy automation across data and AI assets. But tools alone are not a governance model. This guide shows how to design one that actually scales across regulated environments.
Introduction
For fintech and healthtech organizations, governance is not a “nice to have.” It is embedded in laws, supervisory expectations, and customer trust. Financial institutions must prove who accessed which transaction records and on what basis. Healthcare organizations must demonstrate that only authorized personnel touched protected health information (PHI) and that every access aligns with consent and privacy rules.
Databricks Unity Catalog is designed to address exactly this problem. It centralizes governance for data and AI assets, standardizing access policies, classification, and compliance monitoring across the lakehouse.
Yet many regulated organizations face painful audits because they adopted the platform without a clear governance model. A governed data architecture must pair Unity Catalog’s capabilities with domain‑aware design that maps directly to regulatory requirements like PCI DSS, HIPAA, and SOX.
Our blog today explains how to pair Unity Catalog’s capabilities with a domain‑aware governance design that works at scale in fintech and healthtech.
When combined with lakehouse governance best practices, Unity Catalog becomes the single pane of glass for managing data and AI assets across regulated environments – unifying access control, lineage, and compliance monitoring.
The governance challenge
Most data teams in regulated industries start pragmatically – loosen access so experiments can move, and promise to lock it down later. That approach can work in early prototypes, but it quickly becomes unmanageable as more datasets, notebooks, and users pile up.
Common symptoms look like these:
- Hundreds of tables with ad‑hoc grants, but no consistent policy about who can query PII or PHI.
- No clear mapping from business domains (payments, risk, claims, clinical data) to catalog structures and ownership.
- Painful audits where teams manually reconstruct who ran which queries on which data.
Unity Catalog 101 guides emphasize that the platform standardizes governance across tables, files, models, and dashboards, with central policy enforcement and auditability. But they also stress that organizations must still define roles, domains, and classification schemes that map to actual regulations like PCI DSS, SOX, HIPAA, and GDPR. Without that design, you just get a more sophisticated version of the same sprawl.
This is why data readiness for governance must precede platform adoption – cleaning, structuring, and harmonizing operational data so Unity Catalog policies can enforce consistent rules across reliable, well‑understood assets.
What Unity Catalog provides
Unity Catalog is Databricks’ unified governance layer for all data and AI assets in the lakehouse. Key capabilities for regulated industries include:
- Fine‑grained access control
Beyond simple table‑level grants, Unity Catalog supports column‑level access and built‑in mechanisms for dynamic row and column filtering via row filters and column masks, or dynamic views dependent on user identity. This allows one physical table to serve multiple roles – analyst, data scientist, auditor – with different views of sensitive fields. - Lineage and audit trails
Unity Catalog records data lineage across queries, pipelines, and notebooks, and Databricks plus partner resources highlight how this lineage and access logging can dramatically reduce audit preparation time. In regulated contexts, this provides traceability from regulatory reports or models back to source systems.
For organizations adopting streaming architectures, real-time governance extends these lineage and audit capabilities to high‑velocity data, ensuring that every event, transaction, and sensor reading remains traceable even as it flows through streaming pipelines.
- Discovery and classification
Unity Catalog supports discovery across catalogs and schemas and can integrate with sensitive‑data detection and tagging. It also enables policy‑based protection of PII and PHI at scale. Data scientists can find appropriate datasets without ad‑hoc permission tickets, while security teams know which assets carry regulatory risk.
These features are necessary, but not sufficient. Unity Catalog enforces policies, but does not decide what those policies should be.
Designing a governance model that scales
A governance pattern that works for one squad and a handful of tables will collapse in a global bank or health network. To scale, you need clear answers to four questions.
1. Who owns what?
- Define data domains such as Payments, Core Banking, Trading, Claims, Clinical, Patient 360.
- Assign accountable owners (typically business functions with strong compliance support).
Owners are responsible for:
- Data quality SLAs and controls.
- Deciding who gets access to which subsets.
- Ensuring policies align with regulatory obligations.
This aligns with best‑practice guidance that governance must map to business domains.
2. How do you categorize data?
Implement a consistent classification scheme, such as:
- Public
- Internal
- Confidential
- Restricted (for example, PCI‑scoped cardholder data, PHI, or high‑risk attributes)
Unity Catalog’s tagging and classification capabilities let you attach sensitivity labels to tables and columns, which can then drive attribute‑based policies and masking. For example, all “Restricted” columns may be masked by default unless a user is in a specific compliance‑approved group.
3. How do you grant access?
Define standard access patterns per role.
- Read‑only for analysts and most data scientists.
- Write and manage privileges for data engineers and platform teams.
- Admin or owner roles for domain stewards.
Unity Catalog’s privilege model plus row filters and column masks allow you to implement these patterns once and reuse them across datasets, instead of hand‑curating grants. For example:
- A fintech fraud analyst can see transaction attributes but not full PAN or personal identifiers.
- A healthtech researcher can see de‑identified clinical attributes but not directly identifiable PHI.
4. How do you audit?
Regulators expect you to prove:
- Who accessed sensitive data.
- How that data was transformed into reports, models, or downstream datasets.
- Which controls were in place when the access occurred.
Unity Catalog’s lineage, combined with Databricks audit logs and partner‑recommended practices, allows automated audit pipelines that collect access events and lineage graphs into compliance dashboards. This turns ad‑hoc investigations into repeatable processes.
Industry‑specific considerations
Fintech
Financial services must comply with regimes such as SOX, PCI DSS, MiFID II, and regional privacy laws. Governance priorities often include:
- Segregation of duties
The same person should not both develop a pricing or trading model and approve trades or P&L sign‑offs derived from it. Unity Catalog’s role‑based controls and workspace separation help enforce these boundaries. - Comprehensive audit trails
Every access to transaction and cardholder data should be logged and attributable. Implementations in payments highlight how Unity Catalog’s centralized governance and lineage can reduce compliance costs and audit burden. - Data retention and purging
Regulations often specify minimum and maximum retention periods. Delta Lake’s time travel plus scheduled deletion and VACUUM processes support retaining history for required windows while purging data afterward.
Healthtech
Healthcare and life sciences organizations must handle PHI under HIPAA, GDPR, and similar frameworks.
- Patient consent and purpose limitation
Access to PHI must align with the consent given and the treatment, payment, or operations context. Unity Catalog policies and dynamic filtering can restrict views based on user role and purpose tags on datasets. - De‑identification for research
Research workloads often rely on de‑identified datasets. Unity Catalog column masking and data transformations let you enforce de‑identification patterns (for example, tokenizing identifiers, removing direct identifiers) at the schema or view level.
This approach reflects compliance-by-design development, where regulatory requirements are embedded in data models and access patterns rather than retrofitted after deployment.
- Breach detection and notification
Governance setups that centralize logs and lineage make it easier to detect suspicious access and scope potential breaches, supporting mandatory notification timelines.
Building governance on Unity Catalog with Wishtree
For regulated organizations, the difference between a compliant, usable platform and a tangle of one‑off exceptions is often the governance model and its implementation.
Wishtree, a Databricks partner, works with fintech and healthtech teams to turn Unity Catalog into a practical governance foundation:
- Governance strategy and implementation
Design data domains, classification taxonomies, and standard access patterns that align with PCI DSS, HIPAA, SOX, and local privacy laws. Map these to Unity Catalog catalogs, schemas, groups, tags, row filters, and column masks so they are enforceable at query time. - Unified data models for regulated data
Build data models for payments, transactions, claims, and clinical events that embed governance – partitioning of sensitive fields, explicit audit columns, and policies expressed as filters and masks. This reduces the risk of shadow joins that quietly expose combinations of sensitive attributes. - Automated auditing and monitoring
Implement pipelines that aggregate Unity Catalog lineage, Databricks audit logs, and policy changes into dashboards and reports that compliance teams can use directly. Anomalies such as unexpected access patterns or privilege escalations, are surfaced automatically.
For deployments on AWS, Wishtree complements Databricks governance with regulated cloud infrastructure – KMS encryption, IAM controls, private networking – ensuring controls extend from storage and compute through Unity Catalog and into AI workloads. The focus is always on what is necessary for your regulatory environment.
Contact us today to get started!
FAQs
Can Unity Catalog enforce row‑level security?
Yes. Unity Catalog supports row filters that restrict which rows a user can see based on their identity or group membership, as well as column‑masking functions for sensitive fields. This enables a single table to serve multiple personas with different entitlements.
How do we handle data that must be retained for seven years but purged afterward?
Use a combination of retention policies and Delta Lake features. Store regulated data in Delta tables, rely on time travel for historical queries inside the retention window, and schedule deletion and VACUUM operations to purge data after required periods. Governance pipelines should track and report on these retention actions.
Does Unity Catalog work with external data sources?
Unity Catalog can manage external tables and views, applying access policies and lineage to them. However, most implementations aiming for full governance and auditability in regulated industries prefer to land critical data in Delta Lake, where ACID guarantees and finer controls are available.
What if we already have a governance model – do we have to start over?
No. Wishtree typically maps existing governance artifacts – policies, domain definitions, approval workflows, onto Unity Catalog’s constructs – catalogs, schemas, groups, tags, row filters, and masks. We preserve your rules while gaining automation and consistent enforcement.
How does Unity Catalog help with audits in fintech and healthtech?
Unity Catalog centralizes access policies, tags sensitive data, and records lineage across transformations, which can reduce audit preparation time significantly. Instead of manually assembling evidence, you can show policy definitions, access logs, and lineage graphs that answer “who used what, when, and how.”
Can Unity Catalog support both data scientists and strict compliance requirements?
Yes. Using dynamic filtering and masking, you can give data scientists rich feature sets (for example, aggregated or de‑identified data) while hiding direct identifiers and high‑risk fields. This reduces friction between experimentation and compliance.
How do we avoid creating a rigid, innovation‑blocking governance regime?
Design roles and sandboxes where experimentation is allowed on properly de‑identified or synthetic data, while strict policies protect production PII/PHI tables. Unity Catalog’s unified view helps you differentiate controlled domains from exploratory ones without losing oversight.
Does Unity Catalog cover AI models and features, or just tables?
Unity Catalog is being extended as the standard governance layer for data and AI assets in the Databricks platform, including models and other artifacts. This ensures that as fintech and healthtech teams adopt Mosaic AI and agents, the same governance framework applies.
How quickly can a regulated organization realistically roll out Unity Catalog‑based governance?
Timelines vary, but many teams can pilot governance for one domain – such as payments or claims, within weeks by focusing on domain modeling, classification, and a core set of policies before expanding. Attempting to cover everything at once tends to slow progress.
How does Wishtree work with Databricks on governance projects?
Wishtree translates regulatory and internal governance requirements into Unity Catalog‑native models, implements schemas with embedded controls, and builds automated auditing pipelines. Customers retain ownership of the governance framework. Wishtree’s role is to make it executable and sustainable on Databricks.
