Handling personally identifiable information without over-exposing it

Google Cloud provides Sensitive Data Protection (formerly Cloud DLP) as the core service for discovering, classifying, and de-identifying personally identifiable information (PII) across structured and unstructured data. Exam scenarios typically test your ability to choose the right de-identification technique (masking, tokenization, pseudonymization, or generalization) based on whether data must remain analytically useful or fully anonymized. Privacy design also intersects with IAM, encryption, and data residency controls to build compliant end-to-end pipelines.

1 · Learn the must-know

• 1Sensitive Data Protection can inspect data at rest (BigQuery, Cloud Storage) or in-stream (Dataflow) using built-in and custom infoType detectors to find PII like names, emails, and credit card numbers.
• 2Format-preserving encryption (FPE) and deterministic tokenization allow PII to be de-identified while preserving referential integrity for joins across datasets, unlike simple masking which destroys that link.
• 3k-anonymity and other risk-analysis metrics available in Sensitive Data Protection help quantify re-identification risk in quasi-identifier combinations before publishing or sharing datasets.
• 4Crypto-based tokenization methods (e.g., using a wrapped key) support re-identification later by authorized users, whereas hashing/masking is irreversible, choose based on whether reversibility is required.
• 5BigQuery column-level security and dynamic data masking policies can enforce PII access controls at query time without altering the underlying stored data, complementing DLP-based de-identification pipelines.
• 6Data residency and sovereignty requirements (e.g., keeping PII processing within a specific region) should be addressed by configuring regional resources and VPC Service Controls, not just by de-identifying the data itself.

2 · Check your understanding