To deidentify sensitive data, you need to replace the data with cryptographic tokens.

The GCP service that helps you accomplish this is called Cloud DLP (Cloud data loss prevention).