How to Use Google Workspace DLP Rules to Prevent Data Leaks in Drive

Google Drive makes it incredibly easy for employees to share files. Unfortunately, this ease of use can easily lead to catastrophic data breaches if an employee accidentally (or maliciously) shares a spreadsheet containing Social Security Numbers or credit card data via a public link. To mitigate this risk, Google Workspace provides a powerful Data Loss Prevention (DLP) engine that actively scans files in Drive and blocks unauthorized sharing.

Note: Advanced DLP features require a Google Workspace Enterprise standard or Enterprise Plus license.

How Google DLP Works

Instead of relying on users to manually tag files as “Confidential,” the Google DLP engine uses Optical Character Recognition (OCR) and pattern matching (Regular Expressions) to actively scan the contents of every Document, Sheet, Slide, and PDF in your organization. If it detects sensitive information, it triggers a predefined rule.

Step 1: Navigate to the DLP Rules Interface

1. Log in to the Google Workspace Admin console (admin.google.com) using a Super Administrator account.
2. On the left-hand navigation menu, go to Security > Access and data control > Data protection.
3. Click Manage Rules.
4. Click the Add Rule button, and select New rule from templates (which is much easier than building one from scratch).

Step 2: Select a Predefined Detector

Google maintains a vast library of constantly updated detectors for common compliance frameworks (HIPAA, GDPR, PCI-DSS).

1. Scroll through the templates and find the one labeled Prevent sharing of US Social Security Numbers (SSN) (or another template relevant to your region, such as UK National Insurance Numbers).
2. Click the template to start the wizard.
3. Give the rule a descriptive name and choose whether to apply it to the entire organization or specific Organizational Units (OUs). Click Continue.

Step 3: Define the Triggers and Conditions

You must tell the rule exactly what circumstances should trigger an action.

1. Under “Trigger,” ensure File modified is selected. (This forces the engine to scan the file every time a user types new text into it).
2. Under “Conditions,” you will see that the rule is looking for the “US Social Security Number” detector.
3. You can adjust the Confidence threshold (High means it is very strict to avoid false positives, Low means it will trigger on anything that even looks like a 9-digit number).
4. Set the Minimum match count. (e.g., if you set it to 3, a document with a single SSN won’t trigger the rule, but a list of three SSNs will). Click Continue.

Step 4: Define the Actions

This is the most critical step. What happens when the engine finds a violation?

1. Under “Actions,” select Block external sharing. This allows employees to share the document internally with coworkers, but strictly prevents them from emailing it to external domains or creating a public “Anyone with the link” URL.
2. Check the box to Warn users. This will display a popup to the employee explaining why they are blocked from sharing the file, which is vital for user education.
3. Check the box to Send alert to rule center. This generates an audit log for the IT security team to review.

Step 5: Test Before Enforcing

DLP rules can accidentally disrupt legitimate business workflows if configured incorrectly.

On the final summary screen, it is highly recommended to select Test rule rather than “Active.” When in Test mode, the engine will scan files and generate alerts in the Admin console, but it will not actually block the users. Monitor the alerts for a week to ensure you aren’t generating false positives, then return to this rule and switch it to Active to enforce the block.