Customer registration data flows via Pub/Sub into BigQuery. You must redact government ID on ingest but allow customer service to view originals when authorized. Which approach do you use?

The correct approach is to use Cloud DLP with format-preserving encryption (FPE) before loading data into BigQuery. FPE tokenizes the government ID, replacing it with a reversible token that maintains the original format. This allows customer service to decrypt and view the original ID when authorized, while the data in BigQuery remains redacted for general use. Encrypting the ID column with BigQuery AEAD and storing keys separately would require custom decryption logic and key management, which is more complex than Cloud DLP's built-in tokenization. BigQuery column-level security only restricts access to the original data; it doesn't redact the data itself for general viewing. Using a cryptographic hash would permanently obscure the ID, making it impossible for customer service to retrieve the original.