This Google Cloud Platform security best practice is part of the Data Protection security domain.

Appropriate ownership to data and establish procedures to classify, monitor, and update data in accordance with its classification policies. Policies and procedures shall be in place to inventory, document, and maintain data flows to ascertain any regulatory, statutory impact, and to address any other business risks associated with the data.

This is a customer responsibility. The Cloud Data Loss Prevention (DLP) API can help scan PII (credit card numbers, names, social security numbers, US and selected international identifier numbers, phone numbers, and GCP credentials) data and classify sensitive data within text content.