Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. Compare your edition
Frequently asked questions about DLP for Drive
Which predefined content detectors are supported?
DLP for Drive supports a large number of predefined detectors. We'll support more as DLP evolves.
Is detection 100% guaranteed?
No. We can't guarantee that all sensitive data will get caught and flagged. The DLP-detection system translates predefined templates into regular expressions and uses additional content parameters to determine the probability of a match. There might be false positives and negatives, which are triggered by many factors. In addition, not all file types are eligible for scanning and rule evaluation.
How long does it take before a DLP policy takes effect?
It can take up to 24 hours for a DLP policy to take effect.
What rule triggers are available in Drive DLP?
File modification is the trigger for Drive DLP. In addition, Google Forms scans files uploaded as question submissions during the form-submission process.
Can I create rules for specific file types or extensions?
Can I use an API to create and manage data protection rules?
There is no API access.
Do data protection rules apply to Drive files attached in email?
If a user attaches a Drive file to email from "Insert files using Drive", data protection rules with the trigger "Message being sent" don't apply. However, if Google Drive sharing is also selected as a trigger, those rules apply to the Drive files prior to email attachment.
How can I investigate rules and their past results?
Use the security investigation tool. Go to Security investigation tool for details.
Can I create test data protection rules?
Yes, you can create an audit-only rule to test the rule's potential impact. An audit-only rule takes no action except to write results to the Rule log events and the security investigation tool. For details, go to Use audit-only rules to test rule results.
To see examples of sensitive content and to test your own content, try the Sensitive Data Protection Demo.
How many alerts can admins receive?
Admins can receive up to 50 alerts per rule per day. They receive alerts until this threshold is met.
If I add recipients to a rule alert, does that trigger a scan?
No. A scan is triggered if content is modified. Adding more recipients to an alert does not trigger a scan.
Do data protection rules apply to both My Drive and shared drives?
Yes. For files in My Drive, the DLP policy that applies to the file owner is in effect. For files in a shared drive, the shared drive is considered the file owner, and the DLP policy that applies to the shared drive is in effect.
When are alerts triggered?
Alerts are triggered when sensitive content, as defined by a data protection rule, is detected in a file. This can happen when either the file or the rule is created (if the content exists). The actual sharing of the file doesn't trigger alerts.
What does "Triggering user" indicate in a DLP alert? Why is it blank sometimes?
A "Triggering user" is the last user whose change to the document resulted in a DLP scan. It's only populated when the DLP scan happens due to a document change (for example, it isn't set when the scan happens due to a policy change).