Client-side encryption (CSE) adds a layer of encryption on top of Google Workspace's default encryption, one that Google says its servers and third parties cannot decrypt. It relies on an identity provider and an external key service, the Key Access Control List Service (KACLS), that your organization sets up. Until now, people applied it to existing files by making encrypted copies and deleting the originals by hand.

Google's November 5 announcement of Policy-Based Enforcement, now in beta, automates that step. An admin writes a data protection rule, and matching files in My Drive and shared drives are encrypted in place, keeping their original URLs. Google lists Docs, Sheets, Slides, Microsoft Office files, PDFs and images, and it cites compliance requirements such as ITAR, EAR and HIPAA. The feature is off by default, and users have no setting for it. Confirm current coverage and beta availability in Google's documentation before you plan around it.

How the background encryption works

When a rule flags a file, Drive generates a data encryption key (DEK), encrypts the content with it and sends the DEK to your KACLS through its systemwrap endpoint to be wrapped. Google says it does not log or store the unwrapped DEK, and the original unencrypted data is deleted on the Workspace data retention timeline. Afterward, only people your key service allows can decrypt the file.

If Workspace cannot reach the KACLS, the file stays unencrypted and an alert is sent. Google's documented fix is to resolve the network, key service or authentication problem and then run a rescan, described below.

Check whether you qualify

The beta needs the Assured Controls or Assured Controls Plus add-on on top of Enterprise Plus, and you must apply through Google's Policy-Based Enforcement beta application form. Google's setup article also lists Education Standard and Education Plus as eligible editions with the same add-on. Business editions do not appear in that list, so confirm your edition and add-on before spending time on a pilot.

Before you apply, confirm the other prerequisites in that article:

  • CSE for Drive, set up with an identity provider and a key service.
  • CSE for Drive turned on for every organizational unit or group in the rule's scope.
  • Confirmation from your key service provider that the systemwrap endpoint is supported and turned on.
  • Admins with the View DLP rule and Manage DLP rule privileges, plus the Security center and Alert center privileges for checking results.

Plan for outside access separately. Google's external access article says Drive and the Docs editors need a third-party guest identity provider for guests, a point covered below.

Decide whether the trade-offs fit

Because Google cannot read the content, its FAQ says encrypted files and email are not scanned for phishing and malware. Data loss prevention can scan only unencrypted metadata, such as file titles and Drive labels. Vault can retain, search and export encrypted Drive files, but search works on metadata like title and owner, not content.

Google's help article on encrypted files lists further limits. Only one person can edit an encrypted file at a time, and Docs, Sheets and Slides cannot be edited in the mobile apps. Encrypted Docs, Sheets and Slides files are capped at 100 MB. Docs and Sheets can be printed but Slides cannot, and Docs and Slides cannot be downloaded. Grammar check, translation, voice typing and add-ons are unavailable.

Run a pilot only when all of these hold:

  • A regulation, contract or customer requires specific files to stay unreadable to your cloud provider.
  • You can name those files, or the people who will label them.
  • Those people can live with one editor at a time and no phone editing.
  • You qualify, and your key service supports systemwrap.

If most of those answers are no, the pilot will cost more in lost convenience than it returns in protection.

Choose the trigger and build the label

Name the classification that should trigger encryption before you build anything. Drive rules can match on the content of the file, on metadata such as file name and extension, and on a classification label. A label that staff apply on purpose is the most predictable trigger, because a person decides what is confidential, and the DLP documentation says labels are metadata that stay readable.

Content matching has blind spots. Google's DLP for Drive overview says comments in Docs, Sheets, Slides and Drawings, the contents of password-protected files, and video and audio file types are not scanned. File names also stay readable as metadata, so keep client names out of file names.

Labels live under Menu, then Security, then Access and data control, then Label manager, and creating one needs the Manage Classification Labels privilege. A Drive rule can use only a label with a badged field or a single-select Options list field. To control who may apply the label, open it, click Edit in the Permissions pane, choose Restricted access and add only your classifiers under Advanced permissions.

Settle the label's design first. Google says a label used in a data protection rule has its settings locked and cannot be disabled or deleted. Default classification will not label existing files either, since it applies only to new files and ownership changes.

Plan for people outside your organization

List everyone outside your organization who needs access and how each will sign in. Google describes two routes.

In the partner route, external users need a Google Workspace or Cloud Identity license, and their organization must also set up CSE. You must allowlist their identity provider and client IDs with your key service. Consumer accounts and visitor accounts cannot open your encrypted content, and the partner's users share their IP addresses and identity information with your key service.

A guest identity provider (guest IdP) removes those requirements, and guests need no Workspace or Cloud Identity license. It must be OIDC-compliant and is set up with the Configure guest IdP option. For Drive and the Docs editors it must be a third-party provider. Depending on how you set it up, guests sign in with a separate account, a one-time email code or an existing Google, Apple or Microsoft account. It works only in the web apps, and once it is configured, Google ignores the partner setup, so retest your partners.

Know what conversion changes

A file is temporarily locked for editing while it converts. Container-bound Apps Script automations and linked Google Forms are permanently removed from the file, and so are comments in Microsoft Office files. Comments in Docs, Sheets and Slides are kept. For those editor files, the latest revision is encrypted and earlier unencrypted revisions are deleted.

Removed content is exported to encrypted takeout files in a time-stamped folder in the same location. Google's help article adds that checklists, embedded drawings, charts, tables, Connected Sheets and GOOGLEFINANCE formulas become static, while e-signature fields, protected ranges and add-ons are removed.

Users then see a banner reading "Additional encryption was applied to this file by your administrator." Native Google files, images and PDFs can be previewed, and other file types need Download and decrypt. Google's help article for encrypted files describes how to make a copy without the extra encryption, which creates a new file with a new link. Test that route yourself, so you know who is allowed to do it and what it produces.

Set the pilot scope

Scope the rule to an organizational unit or group holding only pilot users, not your whole organization. Google's DLP documentation says groups must belong to your own domain, dynamic groups also need the Security label, and a group takes precedence when it conflicts with an organizational unit.

A My Drive file follows its owner's policy. For shared drives, the rule evaluates the drive's assigned organizational unit or group, not the file's creator. By default, the policies set on the top-level unit apply to every shared drive, including data protection rules.

To move a test drive into the pilot unit, go to Menu, then Apps, then Google Workspace, then Drive and Docs, click Manage shared drives, point to the drive, click More, then Change organizational unit, choose the unit, and click Continue, then Move. That needs the Drive and Docs administrator privilege. The drive then follows that unit's policies, including sharing settings, data region policies and storage limits, so use a new drive holding only test files.

Build a synthetic test set

Use synthetic files, never client data. Give each one a question to answer:

  • A labeled Doc shared with an internal editor, a viewer and an approved outside collaborator.
  • A labeled Sheet with a container-bound Apps Script and a linked Google Form.
  • A labeled Word file with comments, plus a labeled PDF and image.
  • A labeled Doc with several revisions.
  • An unlabeled control file.
  • A labeled file in the pilot shared drive, and a spare labeled file in My Drive.

Run the rule audit-only first

In the Admin console, go to Menu, then Security, then Access and data control, then Data protection, and choose Manage rules, then Add rule, then New rule. Enter a name, check Google Drive and continue. Leave the action empty, because Google's tip is to create an audit-only rule first to see which files would match. An audit-only rule logs every incident and takes no action.

Set the scope to your pilot organizational unit or group, then add a condition on your classification label. Set the rule status to Active and click Create, because an inactive rule exists but does not run.

Matches are recorded in Rule log events. Google says DLP tries to scan all eligible files whenever a rule is added or modified, and that rule changes can take up to 24 hours to take effect, though usually less.

Turn on encryption and run the tests

When the matches look right, edit the rule, add the Apply client-side encryption action, review the impact message and acknowledge it. You can configure alerting, but Google says a DLP rule sends at most 50 alerts per rule per day, so treat Rule log events as the record. Editing a rule triggers a new scan of affected files.

Then test with the real people involved and record:

  • Whether the owner, editor, viewer and outside collaborator can each open the labeled Doc and see the banner.
  • Whether the script, form and Word comments are gone and takeout folders appear.
  • Whether the PDF and image still preview and only the latest revision survives.
  • Whether the control file was left alone.
  • What happens to a converted file when you remove its label or narrow the rule.
  • What happens when the spare file moves into the pilot drive, and when a converted file moves out.
  • Whether the rule matches a copy made without the extra encryption.

Verify the result

Open the security investigation tool, set the data source to Rule log events and filter on your rule name. For each labeled file the Encryption change applied event should show Succeeded for the event status. Google also documents an encrypted files report in the investigation tool: choose Drive log events and set the attribute condition to Encrypted, Is, True.

To find stragglers, add a second audit-only rule with the same scope and label plus a File encryption status condition set to Not client-side encrypted, which Google's FAQ documents. Anything it logs matched your trigger but is not yet encrypted.

If Workspace cannot reach your key service, the Alert center shows a Client-side encryption service unavailable alert with the endpoint URL called and the HTTP status code returned. After fixing the cause, open the rule under Data protection, choose Client-side encryption rescan, then Start rescan, and check for Succeeded again.

Common mistakes and how to spot them

A rule with no conditions applies to all shared or modified Drive files, according to Google's DLP overview. In the audit stage it shows up as a match count far above the number of files you labeled.

An audit-only rule left Inactive records nothing, which can pass for a clean result. Confirm it reads Active before you trust an empty log.

A label that too many people can apply produces false matches, such as brochures labeled by habit. Read every match, and tighten the label's permissions when the wrong people are applying it.

If a shared drive with labeled files shows no matches, compare its organizational unit with the rule's scope. If a collaborator cannot open a converted file, check the key service's access settings first, then their sign-in route.

A readable copy undoes the protection. Google also warns that apps with enough permissions, such as some Chrome extensions, may be able to view and copy encrypted files, and that encryption does not protect against someone viewing your screen.

Brief the pilot users

Before the action goes on, tell pilot users what to expect:

  • A banner and a temporary edit lock during conversion are normal.
  • Only one person can edit at a time, and editing is not available in the mobile apps.
  • Autosave runs about every 30 seconds, so give it time to finish before closing the file.
  • Use Chrome's Basic spell check, which does not send data to Google, rather than Enhanced spell check.

A worked example

Imagine a 40-person engineering firm on Enterprise Plus with Assured Controls that stores export-controlled drawings in Drive. It already runs CSE with a partner key service that supports systemwrap, and Google has allowlisted it for the beta. The admin publishes a badged Controlled label that only five project leads can apply and creates a pilot organizational unit holding six users and a new test shared drive.

A day after the audit-only rule starts, Rule log events show two surprises: a public brochure labeled by mistake, and a project tracker whose container-bound Apps Script sends deadline reminders. The firm relabels the brochure and moves the reminders to a shared calendar, since encryption would permanently remove the script.

Only then does the admin add the encryption action and run the tests with an owner, a colleague, a viewer and a partner whose organization also uses CSE. The partner cannot open the test file until its identity provider is allowlisted with the firm's key service. The firm records what happened when a label came off and when the spare file moved. It widens the scope one team at a time once Encryption change applied shows Succeeded for every labeled file and the straggler rule comes back empty.

Short answers to the next questions

Shared drives need no separate CSE setup, because the key service you configure covers both My Drive and shared drives. You can use more than one key service, choosing one per organizational unit or group. Converted files keep their links, staff cannot opt out of a rule, and an admin can revoke a person's access to keys, even keys that person generated.

CSE turned on by default for an organizational unit is a different control, which Google's FAQ says users can still turn off. Leaving CSE entirely means exporting the items with the Data Export tool or Vault and decrypting them with Google's decrypter utility, a command-line tool.

What to do this week

None of these steps changes a setting:

  • Check your Workspace edition and whether you have Assured Controls.
  • Ask your key service provider to confirm systemwrap support.
  • Pick the trigger label and the few people allowed to apply it.
  • List likely matches that use Apps Script, linked forms, e-signature fields, protected ranges or Office comments.
  • List each outside collaborator and their sign-in route.
  • Note who holds the Manage DLP rule and Manage Classification Labels privileges.

Where ALCO can help

ALCO's listed services include Google Workspace, cybersecurity and compliance, and user training. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources