> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets/google-labels.md).

# Google labels

Oversharing Google Drive files can lead to sensitive data being overexposed, and open the door to the risk of data exfiltration and even malicious data breaches. With DoControl's proactive approach, you can nip any risks and vulnerabilities in the bud before they become major liabilities.

DoControl leverages Google labels with HR and IdP (identity provider) metadata to boost your Google Drive data security beyond its standard capabilities.

{% hint style="info" %}
**What's a Google label?** A tag that’s manually or automatically applied to your Google Drive files, depending on company policy. Google labels help you to organize, find and apply policies to Google Drive files, especially if the content is sensitive or classified.
{% endhint %}

Follow these easy steps to leverage Google label capabilities in DoControl:

1. [Set up labels ](#set-up-google-labels-with-google-workspace-dlp)- Create and apply Google labels with Google Workspace DLP (optional)
2. [View inventory](#view-google-labels-in-docontrol-inventory) - Get maximum visibility into Google labels via DoControl's inventory of your Google assets, and bulk remediate overexposed sensitive Google files.
3. [Mitigate file exposure ](#mitigate-file-exposure-with-google-labels)- Leverage the Get file metadata step in workflows to retrieve Google label data and mitigate future file exposure for assets with specific labels. 
4. [Apply Google labels](#apply-google-labels-via-workflows) - Apply existing Google labels to Google assets via automated workflows

{% hint style="success" %}
DoControl supports organization-wide labels that are open to all users, not a restricted group of users.
{% endhint %}

## Use cases

DoControl empowers your organization to efficiently leverage Google labels across your entire Google Drive. Our automatic processes help to secure and manage your data, while addressing compliance needs. These use cases show how you can leverage Google labels in DoControl:

* **Data classification and security** - Automatically label Google assets based on sensitivity (for example, Confidential, Internal, Public) to enforce DLP policies, such as restricting external sharing.
* **Regulatory compliance** - Regulations such as GDPR and HIPAA require organizations to classify and protect sensitive data. You can leverage DoControl data scanning capabilities to automatically label Google assets in real time.  
* **Visibility and control** - You can filter your entire Google Drive to instantly display assets with specific labels, enabling you to audit and remediate risky sharing behavior.

## Set up Google labels with Google Workspace DLP

Google allows organizations to configure a maximum of 150 unique labels, including 1 badged label. Once configured, you can tag assets across your organization's Google Drive with badges and labels. 

<table><thead><tr><th width="156">Label type</th><th>Elements</th><th valign="top">Display</th></tr></thead><tbody><tr><td>Badge</td><td><p>Indicates your organization’s most critical metadata. For example, a File Confidentiality badge can have these values each with a different color:</p><ul><li>Top Secret</li><li>Internal</li><li>Private</li><li>Public</li></ul></td><td valign="top">Colored badge next to asset name inside the file </td></tr><tr><td>Standard label</td><td>Each label can be structured,  containing up to 10 fields, and each field can contain several values.</td><td valign="top">Metadata tags inside the file details</td></tr></tbody></table>

{% hint style="info" %}

* It's not a must, but DoControl recommends enabling Google Workspace DLP to optimize the Google label feature.
* If you don’t have Google labels yet, set up Google Workspace DLP with DoControl’s [best practices](https://docs.docontrol.io/best-practices/google-labels).
  {% endhint %}

## View Google labels in DoControl inventory

After you set up Google Workspace DLP to support labels, and reintegrate DoControl with Google Workspace, all your Google files are automatically displayed with their relevant Google labels in DoControl’s asset inventory. To minimize overexposure of your sensitive Google files, you can:

* Filter all your Google assets according to Google label, such as Confidential
* Remediate on-demand any overexposed files with inventory actions&#x20;

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FIyzK4Diwexs3sKKiad99%2FGoogle%20labels.png?alt=media&amp;token=2b2a2346-52a4-407e-a07d-e993ed08cf11" alt=""><figcaption><p>DoControl's inventory displays Google labels for each asset</p></figcaption></figure>

{% hint style="warning" %}
It can take up to 2 days to display Google label data in DoControl's asset inventory.
{% endhint %}

## Mitigate file exposure with Google labels

To automatically mitigate file exposure for assets with specific labels, you can leverage Google labels in DoControl workflows using either of these methods:

* &#x20;[Get file metadata](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/get-file-metadata.md) - Retrieve metadata of Google Drive assets, such as their sharing status, the owner, Google labels, or if the file is located in a hidden drive.
* [Customize workflow-triggering events](#customize-workflow-triggering-events) - Leverage Google labels in workflow-triggering events to expedite your DLP data security policies.

<div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FaIxlQICnQMPsxvoz5ke9%2Fimage.png?alt=media&amp;token=111f02fb-f1ea-4fe9-8dd8-9087f35da425" alt="" width="563"><figcaption><p>Google labels are displayed inside the trigger event under Enriched > Labels</p></figcaption></figure></div>

{% hint style="warning" %}
It might take up to 4 hours to display label data in workflow executions.
{% endhint %}

### Customize workflow-triggering events

Leverage Google labels in workflow-triggering events for maximum efficiency and ease:

* **Simplified workflow creation** - Easily add trigger conditions based on labels, eliminating the need for complex DoControl API step calls or file metadata retrieval.
* **Reduced workflow executions** - By validating label conditions at the trigger level, unnecessary workflow executions are minimized, improving efficiency.

#### How can I leverage Google labels in workflows?

For every Google Drive workflow, you can add the Google label macro to the event in order to leverage a specific Google label, such as "Restricted."

DoControl supports organization-wide labels that are open to all users, not a restricted group of users.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FzRfjQwkOKz4vzJJCkjPv%2Fprevent%20public%20sharing%20PB%20Google%20labels.png?alt=media&amp;token=82698ed0-e8e2-46cf-ab43-294be823b4bf" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
To customize a predefined workflow, see DoControl's playbooks:

* [Prevent public sharing of files with sensitive Google label](/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing/google-drive-playbooks-for-public-sharing.md#prevent-public-sharing-of-files-with-sensitive-google-label) - When someone shares files publicly in Google Drive with a sensitive Google label, such as "Restricted," the public sharing links are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the public sharing links are not removed.
* [Prevent external sharing of files with sensitive Google label](/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing/google-drive-playbooks-for-external-sharing.md#prevent-external-sharing-of-files-with-sensitive-google-label) - When someone shares files externally in Google Drive with a sensitive Google label, such as "Restricted," the external collaborators from non-trusted domains are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the external collaborators are not removed.
  {% endhint %}

## Apply Google labels via workflows

To expedite your DLP and data security policies, you can automatically apply existing Google labels to Google assets via workflows.

{% hint style="success" %}
See the [Add Google label ](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md#add-google-label)action step.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/inventory/inventory-assets/google-drive-assets/google-labels.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.