Apply client-side encryption using data protection rules (beta)

Supported editions for this feature: Enterprise Plus; Education Standard and Education Plus. Compare your edition

Requires having the Assured Controls or Assured Controls Plus add-on.

As an administrator, you can use data protection rules to automatically apply Google Workspace Client-side encryption (CSE) to sensitive files stored in Google Drive. When files match the conditions in a data protection rule, Workspace CSE encrypts the files. Only users with keys from your Key Access Control List Service (KACLS) can decrypt and view the content.

Supported files & storage locations

You can use data protection rules that apply Workspace CSE with the following storage locations and file types:

  • Storage locations—My Drive and shared drives.
    For shared drives, rules evaluate files based on the shared drive's assigned organizational unit or group, regardless of which user created or uploaded the file.
  • File formats—Google Docs, Sheets, and Slides, and Microsoft Office files such as .docx, .xlsx, and .pptx. For a complete list of supported file types, go to What's scanned in Drive.

Understand the impact on files & features

Before you turn on a data protection rule that applies Workspace CSE, review how automatic encryption affects files and users in your organization:

  • Unsupported features and exported takeout files—When a file matches a rule and is converted:
    • Features that require server-side access, such as container-bound Google Apps Script automations and linked Google Forms, stop running and are permanently removed from the primary file.
    • For Docs, Sheets, and Slides, the latest revision is preserved and encrypted. Previous unencrypted revisions are deleted.
    • Third-party file comments, such as comments in Microsoft Office files, are permanently removed from the primary file. Comments in Docs, Sheets, and Slides are retained.
    • Google exports removed content to encrypted takeout files. These files are in a time-stamped folder in the same location as the encrypted file.
  • Key wrapping and deletion of unencrypted data—When a file is flagged for encryption, Drive generates a data encryption key (DEK) to encrypt the file content and sends the DEK to your KACLS using its automated systemwrap key-wrapping endpoint. Google never logs or stores the unwrapped DEK. The original unencrypted file data is deleted according to the Workspace data retention timeline.
  • User experience for encrypted files—When users work with encrypted files:
    • While a file is being converted to Workspace CSE, it's temporarily locked for editing.
    • When a user opens an encrypted file in Docs, Sheets, or Slides, they get the following message: "Additional encryption was applied to this file by your administrator." Users can click a link in the message to review the security limitations.
    • Users can preview native files, images, and PDFs. All other file types do not support a preview. To access them, users must select Download and decrypt.

Before you begin

Make sure your organization meets the following requirements before you create a rule:

  • Assign Assured Controls licenses—Your organization must have the Assured Controls or Assured Controls Plus add-on.
  • Set up Workspace CSE for Drive—Set up client-side encryption in the Google Admin console with an identity provider (IdP) and a KACLS. Then, for the organizational units or groups included in your rule, turn on Workspace CSE for Drive.
  • Verify key service support for automated encryption—Data protection rules encrypt files automatically in the background without user action, so your KACLS provider must support the systemwrap endpoint. Contact your key service provider to confirm that systemwrap is supported and turned on.

Create a data protection rule to encrypt content

Tip: To check how many files a rule affects before encrypting content, first create an audit-only rule without selecting an action. Then, review the matched files in the Rule log events.

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Data protection.

    Requires having the View DLP rule and Manage DLP rule administrator privileges.

  2. Click Manage rules and then Add rule and then New rule.
  3. In the Name and apps section:
    1. Enter a name and an optional description for the rule.
    2. For Apps, check the Google Drive box.
    3. Click Continue.
  4. In the Actions section:
    1. For Google Drive, select Apply client-side encryption.
    2. Review the potential impact message.
    3. (Optional) To send notifications when the rule is triggered, in the Alerting section, select a severity level, check the Alert center box, and enter email recipients.
    4. Click Continue.
    5. In the Acknowledgement of impact on data box, review the disclosure and click I understand.
  5. In the Scope and conditions section:
    1. For Scope, keep All in your organization or select Organizational units and/or groups to apply the rule to specific organizational units or configuration groups that have Assured Controls licenses and Workspace CSE turned on.
    2. For Content conditions, click Add Condition and choose the conditions that trigger encryption, such as All content, Title, or Drive labels. You can match content using predefined detectors, word lists, or regular expressions. For details, go to Create DLP for Drive rules and custom content detectors.
    3. Click Continue.
  6. In the Review section:
    1. For Rule status, choose an option:
      • To enforce the rule immediately, select Active.
      • To save the rule to run later, select Inactive.
    2. Click Create.

Scanning the files can take a few hours, a day, or longer, depending on several factors, including the number of files. For details, go to How does DLP for Drive work?

Investigate rule execution in the security investigation tool

To monitor automated encryption actions:

  1. In the Google Admin console, go to Menu and then Security and then Security center and then Investigation tool.

    Requires having the Security center administrator privilege.

  2. For Data source, select Rule log events.
  3. Click Add condition, select Rule name, and choose the rule you created.
  4. Click Search and review the results:
    • Content matched—Shows that a file matched the condition.
    • Encryption change applied—Shows Succeeded when the file is encrypted.
  5. (Optional) To view a file's audit history, change the data source to Drive log events, search for the file, and find the Encrypt event with the DLP Rule actor.

Address KACLS errors in the alert center

If Google Workspace can't connect to your KACLS, the file remains unencrypted and you get an alert in the alert center:

  1. In the Google Admin console, go to Menu and then Security and then Alert center.

    Requires having the Alert center administrator privilege.

  2. Click Add a filter and then Alert type.
  3. Check the Client-side encryption service unavailable box and then click Apply.
  4. Click an alert to review the details:
    • Endpoint—Shows the KACLS URL that was called, such as https://kacls.example.com/systemwrap.
    • HTTP status code—Shows the HTTP response code returned by your KACLS, such as 401, 403, or 500.

Rescan files after resolving errors

If a rule can't encrypt content due to network issues, KACLS downtime, or authentication misconfigurations, resolve the issue and then rescan the files. A rescan can take a few hours, a day, or longer, depending on several factors, including the number of files.

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Data protection.

    Requires having the View DLP rule and Manage DLP rule administrator privileges.

  2. Click Manage rules and then click the rule.
  3. Click Client-side encryption rescan.
  4. In the confirmation box, click Start rescan.
  5. After the scan finishes, verify that the files were encrypted using one of the following methods:
    • From the rule's details page, click Investigate.
    • In the security investigation tool, select Rule log events as the data source and search for your rule.
  6. Confirm that the Encryption change applied event shows Succeeded for Event status.