Question

A healthcare company operates a customer support portal where users upload scanned images of insurance documents and driver's licenses. Before storing these images in a Cloud Storage bucket, the security team must ensure that any personally identifiable information visible in the images (names, ID numbers, dates of birth) is permanently obscured so it cannot be recovered. The solution must work on the image files themselves, not just extracted text. Which Sensitive Data Protection approach should the team implement?

Accepted Answer

Use the Sensitive Data Protection image redaction API with an inspect configuration specifying the relevant infoTypes to detect and black out sensitive regions directly in the image.

Answer

Apply deterministic cryptographic tokenization to the image bytes using a Cloud KMS-wrapped key so the PII can be reversed if needed for auditing.

Answer

Run a Sensitive Data Protection inspection job on the extracted OCR text and store the findings in BigQuery for later review before uploading the original images.

Answer

Enable object-level CMEK encryption on the bucket so that the images are encrypted at rest and PII is protected.