Keeping data storage and access inside a required region or jurisdiction

Data sovereignty in GCP requires controlling the physical location, encryption, and administrative access of data to comply with regional legal and regulatory requirements. Google Cloud provides organization policies, resource location constraints, and specialized service configurations to enforce these controls across storage, processing, and access layers.

Must-know

• Organization Policy Service resource location constraints (constraints/gcp.resourceLocations) let admins restrict where new resources can be created, denying creation in non-compliant regions.
• Multi-region and dual-region storage bucket locations replicate data across geographic areas for availability, but single-region selection is required when strict data residency (data must not leave a specific country/region) is mandated.
• Assured Workloads provides pre-configured environments enforcing data residency, personnel access controls, and compliance regimes (e.g., FedRAMP, EU regions) by restricting where data is stored and who can access it.
• Cloud External Key Manager (Cloud EKM) and Customer-Managed Encryption Keys (CMEK) allow keys to be held outside Google's infrastructure or in a specific region, ensuring Google cannot access data without the customer-controlled key.
• BigQuery datasets, Dataflow jobs, and Cloud Storage buckets each have independent location settings, so a pipeline must have all components (source, processing, sink) configured in compliant regions to avoid inadvertent cross-region data movement.
• Access Transparency and Access Approval logs/require explicit approval for Google support/engineering access to customer data, which is often a requirement alongside data residency for sovereignty compliance.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.