Keeping data storage and access inside a required region or jurisdiction

Data sovereignty in GCP requires controlling the physical location, encryption, and administrative access of data to comply with regional legal and regulatory requirements. Google Cloud provides organization policies, resource location constraints, and specialized service configurations to enforce these controls across storage, processing, and access layers.

1 · Learn the must-know

• 1Organization Policy Service resource location constraints (constraints/gcp.resourceLocations) let admins restrict where new resources can be created, denying creation in non-compliant regions.
• 2Multi-region and dual-region storage bucket locations replicate data across geographic areas for availability, but single-region selection is required when strict data residency (data must not leave a specific country/region) is mandated.
• 3Assured Workloads provides pre-configured environments enforcing data residency, personnel access controls, and compliance regimes (e.g., FedRAMP, EU regions) by restricting where data is stored and who can access it.
• 4Cloud External Key Manager (Cloud EKM) and Customer-Managed Encryption Keys (CMEK) allow keys to be held outside Google's infrastructure or in a specific region, ensuring Google cannot access data without the customer-controlled key.
• 5BigQuery datasets, Dataflow jobs, and Cloud Storage buckets each have independent location settings, so a pipeline must have all components (source, processing, sink) configured in compliant regions to avoid inadvertent cross-region data movement.
• 6Access Transparency and Access Approval logs/require explicit approval for Google support/engineering access to customer data, which is often a requirement alongside data residency for sovereignty compliance.

2 · Check your understanding