Question

A financial services company stores millions of documents in a Cloud Storage bucket. The compliance team wants to continuously discover whether any newly uploaded objects contain unprotected credit card numbers or national IDs, and they want the findings automatically exported to a central location for review and trend analysis over time. They want to minimize custom code. Which approach best meets these requirements using Sensitive Data Protection?

Accepted Answer

Create a Sensitive Data Protection discovery configuration (data profiler) scoped to the bucket that scans data on a schedule and writes profile results to BigQuery.

Answer

Write a Cloud Function triggered by object-finalize events that calls the DLP content.inspect API on each object and stores raw responses in Firestore.

Answer

Apply a de-identification template with format-preserving encryption to every object at upload time so sensitive data never remains in the clear.

Answer

Enable Cloud Storage object versioning and configure a retention policy so auditors can manually review objects for sensitive data.