Question

A financial services company stores customer records in Cloud Storage buckets encrypted with customer-managed encryption keys (CMEK) in Cloud KMS. To comply with a data protection regulation, when a customer requests deletion of their data, the company must guarantee that all copies—including any that may persist in backups or replicated storage—become permanently unrecoverable, and must be able to prove the data is cryptographically inaccessible. What is the most effective approach to meet this requirement?

Accepted Answer

Store each customer's data under a dedicated CMEK key and destroy that key version in Cloud KMS when the customer requests deletion (crypto-shredding).

Answer

Delete the customer's objects from the bucket and rely on Cloud Storage soft delete and object versioning to purge older copies after the retention window.

Answer

Rotate the single shared CMEK key used for all customers so the old key version is no longer primary, then delete the customer's objects.

Answer

Disable the CMEK key temporarily and set an object lifecycle rule to delete the customer's objects after 30 days.