Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus. Compare your edition
DLP for Gmail is also available to Cloud Identity Premium users who are also licensed for Google Workspace editions that include Gmail.
After you create classification labels for your organization, you can create data protection rules that automatically apply labels to email messages. Automatic classification labels help users understand message sensitivity and handle data appropriately. You can also create rules that enforce actions on messages based on their applied labels, such as warning users, quarantining messages, or blocking delivery.
Automatic classification labels help prevent sensitive information from being shared inside and outside your organization, both in Gmail and in third-party email apps.
For detailed steps to set up rules that automatically apply classification labels to email messages, go to About DLP for Gmail.
How automatic classification labels help protect your data
When someone in your organization sends or receives an email message that contains sensitive information, such as a taxpayer ID or passport number, a data protection rule can automatically apply a classification label such as Confidential to the message. The label informs recipients about the sensitivity level of the message.
You can also use data protection rules to take action on messages that have classification labels applied, such as warning users, quarantining messages, or blocking messages. For details about available actions, go to About DLP for Gmail.
Automatic classification labels features and behavior
Rules that automatically apply classification labels to email messages are data protection rules. The features, behaviors, and limitations of data protection rules are described in About DLP for Gmail.
- Rules let you choose from multiple conditions to specify when to automatically apply classification labels to messages.
- Rules can apply labels to messages from a specific organizational unit or group, or to your entire organization.
- Rules apply labels when message content matches conditions you specify in the rule. For example, match a single word, a string, or a predefined data type, such as a taxpayer ID or passport number. You can specify where in the message matching content appears, such as headers, subject line, body, or attachments.
Rules that apply classification labels provide two user permission options for changing labels:
- Don't allow modification: Prevents users from changing label values, even when the user has label editing permissions. When a user tries to change an auto-applied label value, DLP scans the message on send and notifies the user about required labels.
- Allow: Lets users update label values. Values set by the user take precedence over label values automatically applied by rules. If the user changes the value of an auto-applied label, the rule doesn't trigger and the message is sent with the updated value.
With either option, users can't completely remove an auto-applied label. If a user tries to remove a label, the user gets an alert and the label is reapplied.
A message can have up to 20 labels, in any combination of user-applied labels and automatically applied labels. To view labels, users must have View permission for the label. If a user tries to apply visible labels that exceed 20, they get an alert. When combined manual and automatic labels exceed 20, only the 20 top-ranked labels are applied.
You can apply multiple labels with a single rule.
You can use
AND,OR, orNOToperators with conditions. For details, go to Data protection rules with nested condition operators.Rules apply labels through synchronous scanning during compose and at send time, and through asynchronous scanning after send.
Get started with automatic classification labels
Before you start using classification labels and data protection rules with email, you should:
- Gain a general understanding of classification labels. For details, go to Get started as a classification labels admin.
- Create classification labels, or know which existing labels you want to use for email messages. For details, go to Create classification labels.
- Learn how to use rules to take action on email messages with classification labels. For details, go to About DLP for Gmail.
How rules automatically apply classification labels
Data protection rules scan messages and apply labels through synchronous scanning and asynchronous scanning.
Synchronous scanning during compose and at send time
Synchronous scanning evaluates message content in Gmail on the web and the Gmail mobile app:
- During compose: DLP scans message content each time a draft auto-saves, and scans attachment content when an attachment is uploaded. If content matches a rule with an Apply classification label action, the classification label is automatically applied in the Classification row and a notification banner appears in the compose window. If triggering content or attachments are removed from the draft, the auto-applied label is removed.
- When clicking Send: DLP scans the message again before it leaves the
mailbox. This scan checks content added right before send and evaluates any
rules that have a Classification label condition.
- If applying a classification label is the only outcome, sending isn't blocked and the message is sent without a confirmation dialog.
- A blocking dialog appears only if a restricting action also applies, such as Block message, Warn users, Quarantine message, or encryption.
- Label visibility: Labels applied during synchronous scanning are visible to the sender in the compose window and in their Sent mail folder. They are also visible to message recipients.
Synchronous scanning is best-effort and doesn't provide full coverage for all message elements. For example, synchronous scanning can't inspect headers added by email delivery systems after a message is sent, and might not inspect very large attachments.
Asynchronous scanning after send
Asynchronous scanning evaluates messages after they leave the sender's mailbox and before they leave your organization. This provides a safeguard for rules that require post-send data or for messages not evaluated synchronously:
- Coverage: Asynchronous scanning inspects headers added during email delivery, scans large attachments, and evaluates messages sent from third-party email apps using SMTP. Any classification labels not caught during synchronous scanning are applied during asynchronous scanning.
- Label visibility: Classification labels applied after send by asynchronous scanning are available on the recipient's copy in their mailbox. These labels don't appear on the sender's copy in the Sent mail folder.
- Enforcement: If asynchronous scanning blocks or quarantines a message, the sender gets a non-delivery report (NDR) bounce email explaining why the message couldn't be delivered.
How users work with classification labels and other Gmail labels
People in your organization might already use personal Gmail labels to organize their email. Classification labels have a different purpose, and users interact with them differently.
For detailed information about working with classification labels, visit the Gmail help center.
Share your feedback
In the Admin console on any data protection pages, click Send Feedback.