To enforce Data Residency at a platform level, Google Cloud provides the Resource Locations Organization Policy (constraints/gcp.resourceLocations).6 This is the authoritative way to prevent resources (like GKE clusters, Persistent Disks, or Cloud Storage buckets) from being created outside of a specific region.

According to Google Cloud Documentation (Organization Policy - Resource Locations):

"The Resource Locations constraint allows you to define the allowed locations (regions or multi-regions) for all supported Google Cloud services.7 By setting this policy at the project or folder level, you ensure that no user—regardless of their IAM permissions—can create resources in any region other than the one specified (e.g., europe-west4)."

Why this is the best solution:

Preventative: It blocks the API call itself if a user tries to deploy elsewhere.

Efficient: It applies to all services within the project without needing custom code (like Option D) or manual reviews (Option B).

Compliance-focused: It provides a clear audit trail and hard guarantee for compliance officers.