You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the…

Question

Options

• APerform data masking with the Cloud Data Loss Prevention API, and store that data in BigQuery
• BPerform data redaction with the Cloud Data Loss Prevention API, and store that data in BigQuery
• CPerform data inspection with the Cloud Data Loss Prevention API, and store that data in
• DPerform tokenization for Pseudonymization with the Cloud Data Loss Prevention API, and store

• A
  3% (1)
• B
  6% (2)
• C
  8% (3)
• D
  83% (30)

Explanation

Tokenization via Pseudonymization with Cloud DLP replaces sensitive values (email, first name) with cryptographic tokens. Operations teams see only the tokens and cannot read the original PII, satisfying privacy regulations. The HR team can be granted access to the tokenization key and use DLP to re-identify (detokenize) the data on a need-to-know basis. This preserves referential integrity and query capability while protecting the data. Option A (data masking) replaces sensitive values with fictitious but realistic-looking data - it is not reversible, so HR could never recover the original values. Option B (data redaction) permanently removes or blanks the sensitive fields, which is also irreversible. Option C (data inspection) only identifies sensitive fields without transforming them, offering no protection.

No community discussion yet for this question.