Question

A retail company stores customer support chat logs in a Cloud Storage bucket. Compliance requires that any US Social Security Numbers (SSNs) accidentally pasted by agents into these free-text logs be discovered and reported before the data is loaded into an analytics pipeline. The security team wants recurring, automated discovery across the entire bucket, with findings sent to a central location for review, while minimizing cost by not storing full quoted values of the sensitive data. Which approach best meets these requirements?

Accepted Answer

Create a recurring Sensitive Data Protection inspection job on the bucket using the US_SOCIAL_SECURITY_NUMBER infoType, disable include-quote, and route findings to BigQuery and Pub/Sub.

Answer

Enable object versioning on the bucket and write a Cloud Function that regex-scans each new object for nine-digit numbers, storing matches in a spreadsheet.

Answer

Apply a de-identification template with format-preserving tokenization to every object at rest so SSNs are replaced automatically.

Answer

Use a one-time Sensitive Data Protection inspection job with include-quote enabled and export the full findings to a Cloud Storage report file.