--- title: GCP Sensitive Data Protection and Compliance description: "GCP Sensitive Data Protection and Compliance\nAuthor: Zac Harvey, The Jahnel Group Blog." image: https://insights.jahnelgroup.com/hubfs/DALL%C2%B7E%202024-10-03%2010.17.49%20-%20A%20person%20using%20a%20laptop%20with%20glowing%20futuristic%20icons%20floating%20above%20the%20keyboard.%20The%20icons%20represent%20data%20security%2c%20cloud%20computing%2c%20artificial%20inte.webp --- [Skip to main content](https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance#mainContent) [![Jahnel Group logo](https://insights.jahnelgroup.com/hubfs/raw_assets/public/jg-insight/assets/logos/jg-logo-light.svg)](https://jahnelgroup.com/index.html) Menu - [Team](https://jahnelgroup.com/team.html) - [Culture](https://jahnelgroup.com/culture.html) - [Process](https://jahnelgroup.com/process.html) [![Jahnel Group Home](https://insights.jahnelgroup.com/hubfs/raw_assets/public/jg-insight/assets/logos/jg-logo-bars.svg)](https://jahnelgroup.com/index.html) - [Services](https://jahnelgroup.com/services.html) - [Clients](https://jahnelgroup.com/clients.html) - [Contact](https://jahnelgroup.com/contact.html)   ![](https://insights.jahnelgroup.com/hubfs/raw_assets/public/jg-insight/assets/icons/back-icon.png) Insights # GCP Sensitive Data Protection and Compliance [Zac Harvey](https://insights.jahnelgroup.com/author/zac-harvey-1) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [facebook-f icon](http://www.facebook.com/share.php?u=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [Share this page on Facebook](mailto:?body=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [twitter icon](https://twitter.com/intent/tweet?url=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) October 3, 2024 Last updated: November 22, 2024 [Zac Harvey](https://insights.jahnelgroup.com/author/zac-harvey-1) Introduction In today's data-driven world where security and privacy are paramount, the application platforms built and maintained by IT organizations must adhere to a substantial amount of compliance and governance regulations at all times. The [General Data Protection Regulation (GDPR)](https://gdpr-info.eu/) is one such regulatory standard, designed to protect the privacy and personal data of individuals within the European Union. Even if you’re not intentionally selling software services to the European markets, if you have users in areas of the world protected by GDPR, you are required to meet its standards regarding how you collect, store, and process personal data, with significant penalties for non-compliance. As software engineers and members of the [SecDevOps](https://techslang.com/definition/what-is-secdevops/) community, it's crucial to leverage robust tools and practices to ensure that our applications adhere to these regulations. Google Cloud Platform (GCP) offers powerful tools such as Sensitive Data Protection (SDP) that can help enforce GDPR compliance. In this article, we'll demonstrate how to use this tool to enforce specific GDPR requirements. By leveraging SDP, we can continuously monitor our GCP environment and ensure that our data handling practices comply with GDPR standards.   Why GDPR is Important GDPR is essential for several reasons. It enhances the protection of personal data for EU citizens, giving them more control over how their data is used. It also establishes a single set of data protection rules across the EU, simplifying compliance for international businesses. To illustrate how GCP's SDP can help enforce GDPR compliance, we'll focus on one of its key requirements: Data Relevancy and Minimization. In a GDPR-compliant system, personal data should be: adequate, relevant, and limited to what is necessary for the purposes for which it is processed.  In this article, we’ll demonstrate how GCP's SDP can provide a robust framework for GDPR compliance. We'll walk through the steps to set up automatic detection of sensitive data via SDP, and show how SDP helps adhere to data minimization principles.   Enforcing Data Minimization Approach To enforce the Data Minimization requirement, we will start by creating an SDP job that scans a Cloud Storage bucket for sensitive data. This SDP job identifies and classifies sensitive information, such as personally identifiable information (PII), and publishes its findings to a dashboard accessible to SecDevOps. This approach ensures that sensitive data is promptly identified and addressed. Additionally, the Cloud Storage bucket can be configured with a lifecycle policy that automatically deletes data older than 30 days. This policy helps ensure that stale data is regularly purged, reducing the risk of unnecessary data retention. These combined tactics create a robust system for continuously monitoring and minimizing sensitive data, ensuring compliance with GDPR requirements.   Storage Bucket Setup Create the Storage Bucket Before configuring SDP to enforce our GDPR Data Minimization requirement, we will create a Cloud Storage bucket named hellogdpr-data-dev and configure it to have a 30-day retention policy. Any data uploaded to the bucket that is more than 30 days old will now be automatically deleted by Cloud Storage, keeping your platform in lock step with many of GDPR’s data minimization directives. Upload Sensitive Data We will now upload a mock JSON file to our new bucket, called sensitive-data.json. This file contains JSON with a fake US Social Security Number inside of it (900-12-3456). This is a safe SSN to use as it is reserved by the Social Security Administration for precisely these types of testing purposes: | {   "name": "Jerry Jingleheimer",   "ssn": "900-12-3456" } | | --- | By creating this Cloud Storage bucket and uploading the clean data file, we have now set up a baseline dataset for the SDP scans that we will configure next.   Sensitive Data Protection GCP’s Sensitive Data Protection (SDP) service is designed to help organizations identify, classify, and protect data stored within their cloud infrastructure that may be sensitive or even illegal in nature. SDP uses advanced machine learning and pattern matching techniques to automatically detect sensitive information such as personally identifiable information (PII), financial data, and health records across many sources, including Cloud Storage, Big Query, Cloud SQL, Secrets and more.   SDP operates by scanning these configured resources for sensitive information and reporting its findings to a centralized dashboard. It offers several key benefits, including real-time data discovery, best-in-show data classification, and detailed reporting. One of the standout features of SDP is its ability to provide actionable insights and recommendations based on the scans’ findings. This helps organizations take proactive measures to secure their sensitive data, such as implementing data access controls, encrypting data, or redacting sensitive information from datasets. Additionally, SDP integrates seamlessly with other GCP security tools, such as Security Command Center (SCC), to offer a unified view of an organization's security and compliance status. Enabling SDP The first step is to enable SDP services for our GCP project. This step is necessary to ensure that the service is available for configuration and use in the subsequent steps of our GDPR compliance enforcement. In your GCP console, open the navigation menu and look for APIs & Services, and then a Library option underneath that. Search for Sensitive Data Protection API and activate it by clicking Enable: Configure IAM Permissions To ensure that SDP can access and manage your GCP resources, you need to grant appropriate IAM roles. In the GCP Console, go to IAM & Admin and then select IAM. Add the following roles to the SDP service account (format: service-@dlp-api.iam.gserviceaccount.com): - Security Center Administrator - Logs Writer - Environment and Storage Object Viewer By enabling SDP, you have set up the foundational service needed to monitor and protect your GCP environment. This service is now available for configuration, allowing us to integrate it into our GDPR compliance strategy. Sensitive Data Scanner Configuration (SDP Job) Now that SDP is enabled, let's set up a job to scan our bucket once a day. Start by going to the SDP dashboard in the GCP console. Under the Discovery table, click the Enable button under the Cloud Storage option: **![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeMbK-62VviWg7ixk74XI0arganNbfJ3vLa8tJ_JbCMono4y7tRJXMAvhmRBp-TCf5Ts4QT2_KEALZSWLJmlq-KPFwMJkYZL7RoUNOeHstLy8WIC6ZJLxG_20Iv2Cw4JpC79_D8GCbbaDtKUQnZ_E5167RF?key=14M0gTHMwaPdYC6-tbsXmA)**   This will bring you to a page where you can configure your SDP scan: 1. For **Select a discovery type**, select **Cloud Storage** and then **Continue** 2. For **Select a scope**, select **Scan bucket** and then select your Cloud Storage bucket from above. Click **Continue** 3. Leave the **Manage Schedules** and **Select Inspection template** default values as-is. This will produce daily scans and use an inspection template that looks for **US\_SOCIAL\_SECURITY\_NUMBER matches,** amongst many other types of sensitive data. Click **Continue** to advance through both of these sections 4. For **Add Actions** you may optionally enable **Publish to Security Command Center** if you are already using that service. Click **Continue** 5. For **Set location to store configuration**, select **Multi-region** and then **Continue** 6. Finally, under **Review and Create,** click the blue **Create** button   **![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXd5F0z_fj8AHTra98OBkulaS8OZtZIXNk8NUY3nZ9EnksV6mkwsx-H-n4E1IJ9rL8sgJ9kgC7IibKXZzi7jolztsJ7Csmggn7djQIXbYYe5MdQRrwiVI2ne6jp8x8X-jbNxKM_95oXHoi3x84FSuSo9nm5L?key=14M0gTHMwaPdYC6-tbsXmA)**   You will now see your configured scan set up and ready to go under SDP’s **Discovery >> Scan Configurations** tab. Within 24 hours, SDP will automatically kick off and scan your bucket, and you should end up seeing a report similar to this when you next return to SDP’s **Dashboard >> Profiles >> Projects** tab: **![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXch1olG1fjAL91F48AzC37kmUUAfJjBvmwhtnMB6ACcTdQKCB7Hn1USKjhpLXo1UY8bJEa0MmQvp-NAK4vToDGxA0nY8BHkneV5opWGwkWuJHV5oU1sUateWwoEXlJ5l6iDrH-gmcRiqLGIAZVmqCYspLP3?key=14M0gTHMwaPdYC6-tbsXmA)**   As you can see, it's letting us know that it ran a scan and found something that has been categorized as **High Risk**! If you click into that entry, you’ll see a screen very similar to this: **![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXddZ9Rf3SsCIWcPAnsXL95vAdIynlEMgj5JSCFmxECuV9e2kU5C3Z8hFq4t8Y1AJANZYolNHH8ewvI0Cv6HU7pC5SlcO5ytz267NxhkOH6hNL9X9gu1szKyvu7XHJfhpOsHnZxBzhfMRjJu2KhQ9RbufmU?key=14M0gTHMwaPdYC6-tbsXmA)**   Conclusion By setting up GCP’s Sensitive Data Protection (SDP) service to routinely scan a Cloud Storage bucket and flagging any sensitive data detected, you can address any of GDPR’s Data Relevancy and Minimization requirements. This hopefully highlights how GCP’s built-in smart tooling can help automate the enforcement of critical data protection standards, ensuring your applications remain compliant around the clock. [Pricing](https://www.google.com/url?q=https://cloud.google.com/sensitive-data-protection/pricing&sa=D&source=docs&ust=1726771990159609&usg=AOvVaw0WipxbyB2PHVi1Uh9oiLAD) of SDP largely depends on the volume of data being scanned, the source of that data, and the frequency with which it is routinely inspected. A Free Tier is available for trial and experimentation that covers (as of the writing of this article) data up to 1GB in size. By leveraging SDP, you can automate many of GDPR’s reporting, alerting, and enforcement requirements, providing peace of mind that your data handling practices align with regulatory standards. ![Untitled design (21)](https://insights.jahnelgroup.com/hs-fs/hubfs/Untitled%20design%20(21).png?width=731&height=731&name=Untitled%20design%20(21).png) Author Bios Zac Harvey is a Senior Software Engineer at Jahnel Group, Inc., a custom software development firm in Schenectady, NY. At Jahnel Group, we're passionate about building amazing software that drives businesses forward. We're not just a company - we're a community of rockstar developers who love what we do. From the moment you walk through our door, you'll feel like part of the family. To learn more about Jahnel Group's services, visit jahnelgroup.com or contact Jon Keller at jkeller@jahnelgroup.com ## Stay in the know! [Sign up for our newsletter](https://insights.jahnelgroup.com/subscribe) ## Unlock Your Future! #### Send us a message Company First Name Last Name Work Phone Email (Required) Description (Required) ## Related posts [![](https://insights.jahnelgroup.com/hubfs/Untitled%20design%20(41).png)](https://insights.jahnelgroup.com/adapting-to-change-a-c-suite-guide-to-building-resilient-teams) ## [Adapting to Change: A C-Suite Guide to Building Resilient Teams](https://insights.jahnelgroup.com/adapting-to-change-a-c-suite-guide-to-building-resilient-teams) 11.22.2024  -  [Steven Zgaljic](https://insights.jahnelgroup.com/author/steven-zgaljic) [![](https://insights.jahnelgroup.com/hubfs/Untitled%20design%20(53).png)](https://insights.jahnelgroup.com/software-is-a-depreciating-asset-why-your-software-is-never-done) ## [Software Is a Depreciating Asset: Why Your Software Is Never "Done"](https://insights.jahnelgroup.com/software-is-a-depreciating-asset-why-your-software-is-never-done) 11.22.2024  -  [Steven Zgaljic](https://insights.jahnelgroup.com/author/steven-zgaljic) [![](https://insights.jahnelgroup.com/hubfs/Office%20Photo-08-1.jpg)](https://insights.jahnelgroup.com/effortless-object-renaming-automating-large-scale-data-moves-with-s3-batch-operations) ## [Effortless Object Renaming: Automating Large-Scale Data Moves with S3 Batch Operations](https://insights.jahnelgroup.com/effortless-object-renaming-automating-large-scale-data-moves-with-s3-batch-operations) 05.29.2024  -  [Matt Spahr](https://insights.jahnelgroup.com/author/matt-spahr) ![Jahnel Group](https://insights.jahnelgroup.com/hubfs/raw_assets/public/jg-insight/assets/logos/jg-logo-bars.svg) ![Jahnel Group](https://insights.jahnelgroup.com/hubfs/raw_assets/public/jg-insight/assets/logos/jg-logo-bars.svg) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [facebook-f icon](http://www.facebook.com/share.php?u=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [Share this page on Facebook](mailto:?body=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) [twitter icon](https://twitter.com/intent/tweet?url=https://insights.jahnelgroup.com/gcp-sensitive-data-protection-and-compliance) ###### Menu [Home](https://jahnelgroup.com/index.html) [Our Process](https://jahnelgroup.com/process.html) [Services](https://jahnelgroup.com/services.html) [Clients](https://jahnelgroup.com/clients.html) [Contact](https://jahnelgroup.com/contact.html) ###### Company [Team](https://jahnelgroup.com/team.html) [Culture](https://jahnelgroup.com/culture.html) [Careers](https://jahnelgroup.com/careers.html) [Recruiting Services](https://jahnelgroup.com/recruiting-services.html) [Site Map](https://jahnelgroup.com/site-map.html) ###### Media [Photo Gallery](https://jahnelgroup.com/photos.html) [Video Gallery](https://jahnelgroup.com/videos.html) [Press](https://insights.jahnelgroup.com/press) [Insights](https://insights.jahnelgroup.com) [Subscribe](https://insights.jahnelgroup.com/subscribe) ###### Contact *[general@jahnelgroup.com](mailto:general@jahnelgroup.com)* *[(518) 356-0039](tel:5183560039)* *[108 State St, 5th Floor Schenectady, NY 12305](https://g.page/jahnelgroup?share)*