Question

A European financial services company must onboard to Google Cloud while meeting EU digital sovereignty requirements. Their legal team mandates that data storage and processing remain within EU boundaries, that Google support personnel access is restricted to EU-based staff, and that customer approval is required before any Google administrator can access data during support operations. Which approach best satisfies these compliance requirements with the least custom engineering effort?

Accepted Answer

Create an Assured Workloads folder using the 'EU Regions and Support' compliance regime, which enforces EU data residency and personnel controls, and enable Key Access Justifications with Access Approval for administrator access control.

Answer

Apply an organization policy list constraint restricting resource locations to EU regions and rely on default Access Transparency logs to review Google access after the fact.

Answer

Deploy resources into europe-west regions and configure VPC Service Controls perimeters to block all Google support access to the data.

Answer

Use CMEK with an external key manager (EKM) hosted in the EU and manually revoke keys whenever Google support activity is detected in audit logs.