Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. Compare your edition
Before you create any data protection rules for your organization, you should plan and test the content, conditions, and scope. With advanced planning, your data protection rules will more accurately identify sensitive data and apply appropriate actions for data loss prevention (DLP).
Know the limitations of DLP
- There are no guarantees that all sensitive data will get flagged. The DLP-detection system translates rules into regular expressions and uses additional content parameters to determine the probability of a match. There might be false positives and negatives, which are triggered by many factors.
- Data protection rules might not work if you exceed content and rule size limits. For details, go to View DLP content and rule size limits.
Check for recommended rules
If you have the data protection insights report turned on, you can get recommended data protection rules based on the results of the report. For example, if the report lists passport numbers as a shared data type in your organization, you can review a rule to prevent the sharing of passport numbers.
For details, go to Prevent data leaks with data protection recommended rules.
Check if a rule template exists for your requirements
You can use rule templates for common data protection scenarios, for example, to prevent the sharing of financial, health, or personally identifiable information. You can use a template to simplify rule creation and then edit the default values if needed.
For details, go to Create a data protection rule using a predefined template.
Decide on groups for the rule's scope
You can apply the data protection rule to your entire organization or only to certain groups in your organization. If you don't already use groups, you need to set them up before you create the rule. Group addresses must end with your organization's domain. External groups can't be used for a rule's scope.
Data protection rules can use the following types of groups:
- Dynamic groups—Manage memberships automatically when users join, move within, or leave your organization. Available in the Google Admin console or with the Cloud Identity API, dynamic groups help you reduce time spent managing group membership. To use a dynamic group for a data protection rule, make sure it's also a security group (has the Security label). For details, go to Manage membership automatically with dynamic groups.
- Security groups—Convert a standard or dynamic group to a security group, which helps you regulate, audit, and monitor the group for permission and access control. You can create security groups in the Admin console or with the Cloud Identity Groups API. For details, go to Control access to sensitive data with security groups.
- Migrated groups—Use Google Cloud Directory Sync (GCDS) to synchronize groups you create in Microsoft Active Directory or other tools with Google Workspace. Then, use those synced groups in data protection rules. For details, go to About Google Cloud Directory Sync.
Rules apply to files based on the file owners—not who is accessing the files. If the scope is restricted to an organizational unit or group, the rule applies only to files owned by users and shared drives in that organizational unit or group.
Decide on rule conditions
You can create a data protection rule with no conditions. If you do, the rule applies to all relevant files, messages, or events. Or, you can specify conditions that define what sensitive content or activity to scan for.
A rule typically matches content against:
- Standard personal information, such as a driver’s license number or taxpayer ID. Check if your required data type is included in the predefined content detectors.
- Custom content, in the form of regular expressions and word lists. If your sensitive content is not covered by the predefined detectors, you can create your own custom detectors.
- Classification labels, such as Sensitive or NTK. For details, go to Apply classification labels to Drive files automatically with DLP rules and Gmail DLP & automatic classification labels.
- File metadata, such as file name, file extension, or file MIME type.
A rule can combine multiple conditions using AND, OR, or NOT operators. For details, go to Data protection rules with nested condition operators.
Create a test rule
You can create an audit-only data protection rule to test its potential impact without disrupting your users. When triggered, an audit-only rule takes no action except to record events in the Rule log events and the security investigation tool.
To create an audit-only test rule:
- Create a data protection rule. When you get to the Action section, don't select an action. Ensure the rule status is set to Active.
- Choose an option to test the functionality:
- Trigger the rule yourself using test data.
- Wait for your users to share data that might be affected by the rule.
- Monitor the results:
- Open the Rule log events and look for rules where the Action column shows Audit only.
- Review incident details in the security investigation tool.
- After you test the rule, edit it to apply an action, such as blocking or warning.
For more details, go to Best practices for faster rules testing.