Question

A European financial services company must store and process customer transaction data in BigQuery. Regulatory requirements mandate that both the data and the encryption keys used to protect it remain physically within the EU, and the company must be able to permanently revoke access to the data across all copies at any time. Which approach best satisfies these requirements?

Accepted Answer

Create datasets in a single EU region and use Cloud KMS customer-managed encryption keys (CMEK) created in the same EU region, then disable or destroy the key version to revoke access.

Answer

Store the BigQuery datasets in a multi-region 'EU' location and rely on Google's default encryption with Google-managed keys.

Answer

Store datasets in a US region for better performance and encrypt them with CMEK keys created in an EU Cloud KMS location.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to a US-based key ring and store the datasets in an EU region.