Designing a pipeline that meets legal and regulatory constraints

Legal and regulatory compliance in GCP data pipeline design centers on data residency, sovereignty, encryption, and access controls to meet regulations like GDPR, HIPAA, and industry-specific mandates. As a Data Engineer, you must select services and configurations that enforce where data is stored/processed, who can access it, and how long it is retained, while leveraging Google's compliance certifications rather than building compliance from scratch.

Must-know

• Data residency is controlled primarily through resource location settings (e.g., BigQuery dataset location, Cloud Storage bucket location, Dataflow region), and choosing a multi-region vs single-region setting directly impacts where data physically resides.
• Google Cloud offers Assured Workloads to help enforce compliance regimes (e.g., FedRAMP, HIPAA, IL4) by restricting resource locations, personnel access, and encryption key management to meet regulatory boundaries.
• For sensitive data, Cloud DLP (Sensitive Data Protection) should be used to discover, classify, and de-identify (mask, tokenize, redact) PII/PHI before or during pipeline processing to satisfy privacy regulations.
• Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow organizations to control encryption key lifecycle and revocation, which is often a requirement for regulatory frameworks needing demonstrable control over data encryption.
• VPC Service Controls create a security perimeter around GCP resources (e.g., BigQuery, Cloud Storage) to prevent data exfiltration, which is critical for maintaining compliance boundaries in regulated environments.
• IAM audit logging (Cloud Audit Logs) must be enabled and retained appropriately, since regulations like HIPAA and SOX often require demonstrable audit trails of who accessed or modified sensitive data.
• Google Cloud maintains third-party attestations and certifications (e.g., ISO 27001, SOC 2, HIPAA BAA availability) that you should reference in shared-responsibility discussions, compliance is a joint effort between Google's infrastructure controls and your architecture/configuration choices.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.