Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. Compare your edition
Using data loss prevention (DLP) for Google Drive, you can create data protection rules to prevent data leaks and control the sharing of sensitive data in Drive files.
How does DLP for Drive work?
- You create data protection rules to protect the sensitive content in your Drive files, including what actions to take if a rule is violated. DLP tries to scan all eligible files anytime a rule is added or modified.
- Data protection rules apply to both My Drive and shared drives. For files in My Drive, the DLP policy that applies to the file owner is in effect. For files in a shared drive, the shared drive is considered the file owner, and the DLP policy that applies to the shared drive is in effect.
- Scanning the files can take a few hours, a day, or longer, depending on a variety of factors, including the number of files.
- When you add or modify a rule or modify a custom content detector used in a rule, DLP scans the latest revision of previously uploaded files.
- You can create data protection rules specifically for Drive, or for Drive and other Google apps, such as Google Chat or Gmail.
- To help ensure sensitive content is detected, the scanning process sometimes scans documents twice. So the number of files affected by a rule change can vary between scans.
What's scanned?
- Google Sheets, Docs, and Slides
- Google Forms, including files submitted in response to file upload questions and form content (questions and options)
- Google Vids
- Document file types: .doc, .docx, .htm, .html, .ods, .odt, .pdf, .pps, .ppt, .pptx, .readme, .rtf, .tab, .tsv, .txt, .wpd, .xls, .xlsm, .xlsx, .xml, .xps
- Image file types: .arw, .ai, .cr2, .eps, .gif, .jpe, .jpeg, .jpg, .heic, .heif, .png, .ps, .svg, .svgz, .tif, .tiff, .webp
- Compressed file types: .7z, .gtar, .rar, .tar, .tgz, .zip
- Source code file types: .c, .c++, .cc, .cpp, .cs, .cxx, .d, .h, .h++, .hh, .hpp, .hs, .hxx, .java, .js, .lhs, .mjs, .pas, .php, .pht, .pl, .pm, .py, .sh, .sql, .tcl
- Other file types: .323, .asc, .bib, .boo, .cfg, .cls, .conf, .csh, .css, .csv, .diff, .dot, .dxf, .eml, .etx, .gcd, .har, .htc, .hwp, .ics, .icz, .jad, .json, .kml, .kmz, .log, .ltx, .m, .markdown, .md, .mdown, .mht, .mhtml, .mkd, .mkdn, .mml, .moc, .mrw, .msg, .nrw, .odp, .orf, .p, .patch, .pef, .phtml, .pot, .raf, .rtx, .rw2, .sct, .sdc, .sdd, .sdw, .shar, .shtml, .strings, .sty, .sxc, .sxi, .sxw, .taz, .tex, .text, .tk, .tm, .ts, .uls, .url, .vcf, .vcs, .wml, .wmls, .wsc, .xht, .xhtml, .xlb, .xlt, .xltm, .xsl
- File metadata, such as file names, suggestions, and labels.
For details on content limits, go to Google Drive DLP content limits.
What's not scanned?
- Comments in Google Docs, Sheets, Slides, and Drawings
- Sites content
- Forms responses (other than file uploads)
- Contents of password-protected files
- Video and audio file types
Understand triggers
Before defining what content your rule should look for, you specify the trigger that starts the DLP scanning process. The trigger for Google Drive is Drive files. Modifying the file activates the data protection rule.
Understand DLP actions
When sensitive content is found, your rule enforces an action. You can choose from the actions listed in the following table.
If you have similar rules with different response actions, the stricter action takes precedence. For example, if one rule warns users when a Social Security number (SSN) is found and another rule blocks the user from using SSNs, the action is blocked and the user can't share the file.
| Action | Description |
|---|---|
| Block external sharing |
Prevents a document from being shared. The event is logged. If you have a rule that blocks external sharing, users outside of your organization can't view the version history of files that have ever had any rule applied to them. This stipulation includes rules that apply labels but don't block external sharing. |
| Warn on external sharing |
If a user tries to share a file, they are warned that the file includes sensitive content. The user can cancel or share anyway. The user's choice is logged. If you turn on alerts for this action, they're triggered when sensitive content is detected, whether or not the file was shared at that time. Detection usually happens after a file is created or updated or after rules are applied to the file change. It can also happen when a system upgrade improves detection ability. Detection events are recorded in the Rule log events. |
| Disable download, print, and copy |
Prevents users from downloading, printing, and copying files. For details, go to Prevent users from downloading, printing, or copying files. You can combine this action with Context-Aware Access conditions. |
| Apply classification labels |
Applies an existing classification label to matching files. A data protection rule can't have a classification label as both a condition and an action. For details, go to Apply classification labels to Drive files automatically with DLP rules. |
| Audit only |
Lets the user proceed without interruption and logs the event. |
Understand DLP conditions
You can create a data protection rule with no conditions. In this case, the rule applies to all shared or modified Drive files.
Or, you can specify conditions in the data protection rule that define what content or activity to scan for. You can use predefined data types or create your own custom content detectors. You can also combine multiple conditions using AND, OR, or NOT operators.
For details, go to How to use predefined content detectors, Create a custom detector, and Examples of rules with nested condition operators.
| Content type to scan | What to scan for | Details & use |
|---|---|---|
| All content |
Matches predefined data type Contains text string Matches regular expression Matches words from word list |
Scans all content, including the title, body, and any suggested edits. Takes action if sensitive information is found that matches one of the following parameters:
|
| Body |
Matches predefined data type Contains text string Matches regular expression Matches words from word list |
Scans the body of the file for sensitive information. |
| Classification label |
Is |
Whether a classification label has been applied to the file. A data protection rule can't have a classification label as both a condition and an action. For details, go to Apply classification labels to Drive files automatically with DLP rules. |
| File encryption status |
Is not client-side encrypted Is client-side encrypted |
Whether the file is encrypted. For details, go to Protect your organization's data with CSE. |
| Suggested edits |
Matches predefined data type Contains text string Contains word Matches regular expression Matches words from word list |
Scans content added to the file while in Suggesting mode. |
| Title |
Matches predefined data type Contains text string Contains word Ends with Starts with Matches regular expression Matches words from word list |
Scans file titles for sensitive information. |
Create a rule
After you decide what you want your rule to do, you create the rule. For details, go to Create data protection rules.
Common use cases
The following table provides examples of how to combine a trigger (what the user does), conditions (what is checked), and a specific action (the enforcement) to define your DLP policy. To use this table, you must:
- Select a trigger.
- Map condition values to the corresponding options.
- Select an action.
| Use case | Trigger | Condition | Action |
|---|---|---|---|
| Block file from being shared if any content includes Social Security Numbers | Google Drive |
Content type: All content Match: Matches predefined data type Data Type: United States - Social Security Number Likelihood Threshold: High Minimum unique matches: 1 Minimum match count: 1 |
Block external sharing |
| Block Drive external sharing and Chat message attachments that contain a passport number | Google Drive AND Google Chat |
Content type: All content Match: Matches predefined data type Data Type: Global - Passport Number Likelihood Threshold: High Minimum unique matches: 1 Minimum match count: 1 |
Google Drive: Block external sharing Google Chat: Block message |
| Warn users when sharing a file if the title contains the project codename or acronym | Google Drive Drive files |
Condition 1: Match: Contains text string Value: SpiderWeb
Condition 2: Match: Contains text string Value: SpdW |
Warn on external sharing |
Review, monitor & investigate alerts
- View incidents on the security dashboard.
- View details of incidents in Rule log events.
- Investigate alerts of data-sharing incidents using the security investigation tool. For details, go to About the security investigation tool.
- Investigate data protection rule violations to determine if they're real incidents or false positives. For details, go to View content that triggers DLP rules.