Your web application must comply with GDPR. As the architect, what should you do?

The correct answer is to design and document the application’s data security architecture to meet GDPR requirements. As the architect, your primary responsibility is to ensure the application itself is designed to handle personal data in a compliant manner, which includes documenting how data is collected, processed, stored, and protected. This proactive design approach is fundamental to GDPR compliance. Restricting to native GCP services is insufficient because while GCP provides a secure and compliant infrastructure, your application's design and implementation on top of it are critical for GDPR. There isn't a single "GDPR compliance setting" in the GCP Console; compliance is achieved through a combination of service configurations, organizational policies, and application design. While Cloud Security Scanner is useful for identifying security vulnerabilities, it doesn't automatically ensure GDPR compliance, which requires a broader scope including data governance, consent management, and data subject rights.