> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/best-practices/google-labels/google-workspace-dlp.md). # Google Workspace DLP Users and organizations create and share more sensitive data than ever before. After this data is shared with internal and external collaborators, it can then be shared with 4th party collaborators, resulting in overexposure of sensitive information. Google Workspace DLP is a cloud-based Google service that detects and prevents the loss of sensitive data from your Google Workspace. Sensitive data includes customer information, social security numbers, credit card data, intellectual property, trade secrets, financial statements, business plans and personal health information. * Google Workspace DLP scans all docs, sheets and slides in your organization’s My Drives and shared drives. In addition, compressed files and custom files are also scanned. Video and audio files are not scanned. For a list of all apps and file types that are scanned by DLP, see [Google Workspace Admin Help](https://support.google.com/a/answer/9646351?hl=en\&sjid=16517209147006475605-EU\&visit_id=638441095154274222-453733644\&ref_topic=9646660\&rd=1). * Plans that support Google Workspace DLP include: * Enterprise Standard * Enterprise Plus * Enterprise Essentials Plus {% endhint %} ## DLP use cases You can leverage Workspace DLP to address a range of use cases: * Define DLP (data loss prevention) policies and classification labels based on rules. * Scan your organization’s Google Drive for files that violate DLP policies, such as files with sensitive content. * If a file is found in violation of an organization policy, Google Workspace DLP can take action, such as blocking the data from leaving your organization, warning end users not to share sensitive data outside your organization, quarantining an email, encrypting a file, or alerting your security team. * Configure Google Workspace DLP to automatically apply classification labels to each file scanned in your organization’s Google Drive, based on predefined rules. ## Set up Google Workspace DLP You can set up Google Workspace DLP in Google Admin Console to apply labels to each file in your Google Drive based on rules. {% hint style="warning" %} To define Google Workspace DLP rules, sign in to your **super administrator** account or a **delegated admin** account with these privileges: * Organizational unit administrator privileges * Groups administrator privileges * View DLP rule and Manage DLP rule privileges: It's recommended to create a custom role with both privileges. * View Metadata and Attributes privileges {% endhint %} 1. Login to **Google Admin Console > Menu > Security > Access and data control > Data protection**. 2. Click **Manage Rules**. Then click **Add rule > New rule** or click **Add rule > New rule from template**. For templates, select a template from the Templates page. 3. Add the name and description of the rule. 4. In the **Scope** section, select **All in** <`domain.name`> or apply this rule only to users in selected organizational units or groups. 5. Click **Continue**. In the **Apps** section, choose **Drive files**. 6. Click **Continue**. In the **Conditions** section, click **Add Condition**. 7. Choose the **Content type to scan**: * **All content** - All of the document, including the document title, body, and any suggested edits * **Body** - Body of the document * **Drive label** - Any labels applied to the document. For details, see [Get started as a Drive labels admin](https://support.google.com/a/answer/9292382). * **Suggested edits** - Content added to the document while in Suggestions mode * **Title** - Document title 8. Select what to scan for from the [Google Drive table](https://support.google.com/a/answer/9655387#zippy=%2Ccreate-a-dlp-rule). 9. If you chose **Drive labe**l as the content type, choose: * **Drive label -** Choose an available Drive label from the dropdown list. * **Label field -** Choose an available label field for the selected Drive label. * **Field option -**Choose an available field option for the selected field. 10. Click **Continue.** In the **Actions** section, click **Apply Drive labels** to apply an existing Drive label to matching files. Follow these steps to configure: * Choose an available label from the **Drive label** dropdown list, then select an available **Field** and **Field option** for the label. Only badged labels and standard labels with **Options list** field type are supported. For details, see [Get started as a Drive labels admin](https://support.google.com/a/answer/9292382). * (Optional) Click **Add label** to add additional labels. * Choose whether to allow users to change labels and field values applied to their files. 11. Click **Continue**. In Rule status, choose **Active** to run the rule immediately. 12. Click **Create**. Changes can take up to 24 hours but typically happen more quickly. {% hint style="info" %} For more information on how to set up Workspace DLP, see Google’s [Admin Help](https://support.google.com/a/answer/9646351?hl=en) and [FAQs](https://support.google.com/a/answer/9656855?hl=en\&ref_topic=9646660#zippy=%2Cwhat-content-is-scanned-in-each-drive-file%2Chow-long-does-it-take-before-a-dlp-policy-takes-effect%2Cwhich-predefined-content-detectors-are-supported) on Workspace DLP for Google Drive. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/best-practices/google-labels/google-workspace-dlp.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.