BigQuery is designed for large-scale data analytics and provides robust, built-in auditing capabilities. By controlling access to datasets via IAM (Identity and Access Management), you ensure only authorized personnel can query the data. Critically, BigQuery automatically generates Data Access audit logs for actions that read data, such as running a query. These logs capture the user's identity (principalEmail), the timestamp, and the exact query executed. This creates a direct, tamper-evident, and auditable trail of data access, fulfilling the regulatory mandate without requiring custom development.

A. Managing user-supplied keys externally makes auditing difficult. Google Cloud logs the service account that requested the data, but it cannot audit which end-user used the external key to decrypt it.

C. Cloud SQL Admin activity logs track administrative changes (e.g., editing an instance), not data access operations like SELECT queries. This log type is insufficient for the specified audit requirement.

D. This approach relies on a custom-built application for logging. This is less reliable and more complex than a native, managed audit logging service and places the burden of creating a compliant audit trail on the developer.

1. Google Cloud Documentation - Cloud Audit Logs with BigQuery: "Data Access audit logs contain log entries for API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data... BigQuery writes Data Access audit logs for the following APIs... google.cloud.bigquery.v2.JobService.Query". This confirms that user queries are logged, providing the required audit trail.

2. Google Cloud Documentation - Overview of Cloud Audit Logs: "Data Access audit logs: Entries for operations that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data." This defines the purpose of Data Access logs, which directly matches the question's need.

3. Google Cloud Documentation - Cloud SQL Audit Logging: "Admin Activity audit logs contain log entries for operations that modify the configuration or metadata of a Cloud SQL resource." This explicitly states that Admin Activity logs are for configuration changes, not data access, making option C incorrect.

4. Google Cloud Documentation - Customer-Supplied Encryption Keys (CSEK): "Cloud Storage does not store your key on Google's servers or otherwise manage your key. Instead, you provide your key for each operation, and the key is purged from Google's servers after the operation is complete." This highlights that key management is external, making it impossible for Google's native audit logs to track which end-user's key was used.