How to Configure Google Workspace Email Quarantine and Compliance Rules

The Compliance Mandate

In highly regulated industries (such as Finance or Healthcare), companies are legally mandated to prevent the transmission of sensitive data. If an employee accidentally attaches a spreadsheet containing 500 unencrypted Social Security Numbers (SSNs) or Credit Card numbers to an outbound email, the company could face millions of dollars in HIPAA or PCI-DSS compliance fines.

You cannot rely on employee training alone to prevent these data leaks; you must enforce it at the server level. Google Workspace Email Quarantine allows system administrators to build strict content compliance rules. When an employee clicks “Send” on an email containing an SSN, Google’s servers intercept the message, prevent it from routing to the internet, and place it in a hidden Quarantine vault. A security officer must then review the email in the vault and either manually approve the transmission or forcefully reject it.

Step 1: Creating the Quarantine Vault

Before you can route emails to quarantine, you must build the vault and assign administrators who have the authority to manage it.

1. Log into the Google Workspace Admin Console using Super Administrator credentials.
2. Navigate to Apps > Google Workspace > Gmail > Manage quarantines.
3. Click Add Quarantine.
4. Name it DLP-Compliance-Vault.
5. Under Reviewers, select the specific Google Group that contains your security officers (e.g., [email protected]). Never assign quarantine review rights to a single individual, as emails will become permanently stuck if that person goes on vacation.
6. Click Save.

Step 2: Building the Content Compliance Rule

Now you must create the logic that triggers the quarantine.

1. Navigate to Apps > Google Workspace > Gmail > Compliance.
2. Scroll down to the Content compliance section and click Configure (or Add another rule).
3. Name the rule Block SSN and Credit Card Transmission.

Defining the Conditions

1. Under Email messages to affect, check Outbound and Internal – sending.
2. Under Add expressions that describe the content, click Add.
3. Change the dropdown to Predefined content match.
4. Select United States Social Security Number (SSN).
5. Click Add again, select Predefined content match, and choose Credit Card Number.
6. Ensure the logic is set to If ANY of the following match the message.

(Note: Google’s predefined algorithms are incredibly smart. They do not just look for 9-digit numbers; they validate the checksums of credit cards to prevent false positives).

Step 3: Defining the Action

When an email triggers the condition, you must tell Google what to do with it.

1. Scroll down to Step 3 (If the above expressions match, do the following).
2. Select Quarantine message.
3. Select the DLP-Compliance-Vault you created in Step 1.
4. Optional but Recommended: Check the box to Append custom text to the rejection notice and inform the employee: “Your email was flagged for containing sensitive data and is pending security review.”
5. Click Save.

The Review Workflow

The rule is now active domain-wide. When a user sends a flagged email, it disappears into the vault. The members of the [email protected] group can log into the Admin Console, navigate to the Quarantine section, and read the full contents of the blocked email.

If the email contains legitimate corporate data that was incorrectly flagged, the officer clicks Allow, and the email is instantly released to the internet. If it is a genuine compliance violation, the officer clicks Reject, the email is destroyed, and the original sender receives a bounce-back notification.