https://cloud.google.com/nat/docs/overview

This approach allows you to create a boundary that controls access to Google Cloud resources for services within the same perimeter. By creating an access level based on the authorized source IP address as the condition, you can ensure that only requests from authorized IP addresses are allowed to query your BigQuery tables. This effectively prevents data exfiltration and ensures that your sensitive BigQuery workload is not accessible from the internet.

https://cloud.google.com/architecture/de-identification-re-identification-pii-using-cloud-dlp
https://cloud.google.com/blog/products/identity-security/taking-charge-of-your-data-using-cloud- dlp-to-de-identify-and-obfuscate-sensitive-information.
Using the Cloud Data Loss Prevention (DLP) API to scan and redact PII, combined with format- preserving encryption, directly addresses the need to protect sensitive data while maintaining the necessary format for testing. This ensures that the development team can perform their tests without exposing real PII.