Professional Data EngineerEnsuring solution qualityMedium
A global pharmaceutical company is building a new data lake on Google Cloud to store vast amounts of clinical trial data. This data includes highly sensitive patient information, which must be protected according to strict regulatory compliance (e.g., HIPAA, GDPR) and internal privacy policies. The company needs a solution to classify, discover, and protect this sensitive data across various data stores (Cloud Storage, BigQuery, Cloud SQL) without manually inspecting every dataset. Which Google Cloud service should the company leverage to meet these requirements efficiently?
- ACloud SQL Proxy for secure connections to Cloud SQL instances containing sensitive data.
- BCloud Identity and Access Management (IAM) for fine-grained access control to datasets.
- CCloud Data Loss Prevention (DLP) for automated sensitive data discovery and classification.
- DCloud Audit Logs for tracking data access and modification events.
Show answer & explanationAnswer & explanation
Correct answer: C. Cloud Data Loss Prevention (DLP) for automated sensitive data discovery and classification.
Cloud Data Loss Prevention (DLP) is specifically designed to discover, classify, and protect sensitive data across various Google Cloud services. It can automatically identify personal identifiable information (PII) and other sensitive data types, which directly addresses the company's need for compliance and privacy without manual inspection.
Why the other options are wrong
- A. Cloud SQL Proxy secures connections to databases but does not help with identifying or protecting sensitive data within the data lake across multiple services.
- B. IAM controls who can access data, but it does not discover or classify sensitive data within the datasets themselves.
- D. Cloud Audit Logs track activity but do not provide capabilities for discovering or classifying sensitive data content.
Cloud Data Loss Prevention (DLP)
A fully managed service on Google Cloud that helps discover, classify, and protect sensitive data, including PII, across various data stores.
- Automates sensitive data discovery and classification.
- Supports de-identification techniques like masking, tokenization, and redaction.
- Integrates with Cloud Storage, BigQuery, Cloud SQL, and more.
Memory trick: To keep data safe, first you must See it, then Label it, then Protect it.