GCP PCA · Question 13 · Design for Security

CASE STUDY: AutoMakers Inc

Company Overview:
AutoMakers Inc is a leading vehicle manufacturer transitioning to connected and autonomous vehicles. They need a platform to ingest, process, and analyze telemetry data from millions of cars.

Current Technical Environment:

• Legacy MQTT brokers on-premises.
• Hadoop cluster for batch processing (nightly runs).
• 100,000 connected cars sending 1 KB of data every minute.
• On-premises data warehouse reaching capacity.

Business Requirements:

• Support 5 million connected cars within 3 years.
• Enable real-time alerting for critical vehicle faults.
• Provide predictive maintenance insights to customers.
• Monetize anonymized traffic data.

Executive Statements:

• CEO: "Data is our new engine. We need real-time insights to improve safety."
• CFO: "The platform must scale cost-effectively. We only want to pay for what we use."
• CTO: "We need a fully managed serverless data pipeline to minimize operational overhead."

Technical Requirements:

• Ingest up to 1 million messages per second with low latency.
• Process data in real-time for anomaly detection.
• Store raw telemetry data indefinitely for machine learning model training.
• Provide a scalable data warehouse for business intelligence analysts.

Constraints:

• Strict data privacy regulations (GDPR) require masking of PII.
• Limited data engineering staff; prefer managed services.
• Must integrate with existing on-premises identity provider (Active Directory).

QUESTION:
How should you ensure compliance with GDPR requirements for masking Personally Identifiable Information (PII) before the data is stored or analyzed?