Question

A financial services company ingests customer support chat transcripts into a BigQuery dataset used by data analysts to build product improvement dashboards. Compliance requires that analysts must never see raw personally identifiable information (PII) such as credit card numbers, national IDs, and email addresses, but the analytics must remain useful (aggregations, trends). The security team wants a scalable, managed approach that transforms the sensitive fields before analysts query them, while preserving the ability to correlate records. What should the architect recommend?

Accepted Answer

Use Sensitive Data Protection (Cloud DLP) to inspect and de-identify the data using format-preserving encryption/tokenization before or during load into an analyst-accessible BigQuery dataset.

Answer

Grant analysts the BigQuery Data Viewer role only during business hours and rely on Cloud Audit Logs to detect any misuse of PII.

Answer

Store the raw transcripts in a Cloud Storage bucket with CMEK encryption and give analysts read access to the bucket instead of BigQuery.

Answer

Apply BigQuery column-level IAM to hide PII columns entirely, removing them from all analyst queries.