Zone Architecture Cheat Sheet
The diagram you draw on a whiteboard in every first meeting. Abbreviations: SDP = Sensitive Data Protection; HMAC = keyed-hash MAC; FPE = format-preserving encryption; DDM = dynamic data masking; ARX = structural anonymization tool; MSISDN = subscriber phone number; QI = quasi-identifier.
The four-zone model
| Zone | Content | Access | Retention | GCP services |
|---|---|---|---|---|
| 0 — Raw | Unmodified source data, full PII | Ingestion pipelines + break-glass only | Days to weeks | Pub/Sub, GCS, Dataflow |
| 1 — Pseudonymized | Direct IDs replaced; QIs at original granularity | Engineers (full), analysts (DDM-masked) | Months to years | SDP, Cloud KMS, BigQuery + DDM |
| 2 — Structurally anonymized | k-anonymous record-level data | Broad internal — analysts, BI | Years or indefinite | ARX (Cloud Run job), BigQuery |
| 3 — DP-guaranteed | DP aggregates, DP-trained synthetic data | Widest — partners, regulators, monetization | Indefinite | Privacy on Beam, BigQuery DP |
When to use 4 zones: Data leaves the organization, or record-level + aggregate outputs coexist. When 3 zones suffice: All anonymized data serves the same consumers, or only aggregate outputs produced. Critical rule: DP aggregation sources from Zone 1 (full granularity), NOT Zone 2 (already generalized).
Zone adaptation by vertical
| Dimension | Telco | Retail | Financial services | Energy |
|---|---|---|---|---|
| Zone 0 retention | Days (ePrivacy) | Days to weeks | Years (AML mandates) | Days |
| Zone 1 anchor | MSISDN | Canonical customer ID | Account number | Meter ID |
| Zone 1 technique | HMAC; FPE if format needed | Deterministic encryption | Tokenization (PCI); HMAC | HMAC |
| Zone 2 approach | k-anonymity (k ≥ 50 internal, 100+ external) | k-anonymity + sequence aggregation | k-anonymity on analytical derivatives | Temporal aggregation |
| Zone 3 primary use | Mobility analytics, monetization | Marketing, partner sharing | Risk modeling, regulatory reporting | Grid planning, demand forecasting |
| Hardest problem | Mobility sequence uniqueness | Cross-domain identity | AML retention prevents anonymization | NILM inference |
3 architecture decisions that transfer across every vertical
| Decision | Options | Choose based on... |
|---|---|---|
| Pipeline vs. query-time | Pipeline (SDP in Dataflow) or query-time (BigQuery DDM). Most use both. | Most consumers need pseudonymized → pipeline. Different teams need different views → DDM. |
| Key architecture | HMAC (irreversible), FPE (format-preserving), det. enc. (reversible, stateless), tokenization (reversible, stateful) | Re-identification needed? Format compatibility? Cross-system joins? |
| DP budget | Sequential composition, parallel composition, Rényi DP | Telco → mobility. Retail → conversion. Finance → risk. Energy → demand. |