What to take away
Google Workspace DLP applies data-protection rules to supported content. A Drive sharing review adds two questions: who has access now, and why do they still need it? Use this workflow to connect sensitive-data findings, permissions, and owner decisions to a verified outcome.
1. Separate content, permissions, and business need
Google’s Drive DLP documentation describes rules that inspect eligible content and apply configured actions, including warnings or blocks on external sharing. Availability depends on your Workspace edition and administrative privileges. Check the current provider documentation before choosing controls.
Your review also needs an account of the audience and the business reason for sharing. A confidential file can have appropriate access, while an ordinary project document can still expose information to an obsolete collaborator. Use the three views below together when choosing what to investigate.
| View | Question it answers | Evidence to retain |
|---|---|---|
| Content and DLP | Does supported content match a sensitive-data rule? | Rule, finding, scope, and observation date |
| Sharing permissions | Which people, groups, or link audiences have access? | Current permission details and drive context |
| Owner review | Is this audience still needed for the work? | Decision, business reason, and exception owner |
| Verification | Did the intended access change actually happen? | Source state checked after the change |
References: Google — About DLP for Drive
2. Define the scope and collect a dated view
Start with a business area, sensitive project, or group of external collaborators. Identify the relevant My Drive and shared-drive content, responsible owners, and review date. Decide how you will examine public links, named external recipients, and group-based access. Record any areas you cannot inspect.
For each item, keep a file reference, owner, location, audience, sensitivity signal, proposed action, and decision owner. Include the date of collection. A file can change between discovery and review, so check the current source before making a correction. Keep investigation records limited to what reviewers need; copying the sensitive document into a tracking sheet creates another exposure to manage.
3. Review native rules and sharing evidence
Inventory the Google sharing policies and DLP rules that apply to your scope. Google recommends audit-only rules as a way to test rule results before applying an enforcement action. Use synthetic sample content and representative collaboration scenarios to examine which rules match and what a legitimate user experiences.
Google’s Drive log events provide evidence about recorded activity and sharing changes. Treat that history as context for the investigation, and inspect current permissions to decide who can access a file now. A historical event does not by itself establish the present audience.
Native Drive DLP also has content limitations. Google lists exclusions such as password-protected file contents and certain document comments. An absence of a finding should therefore be assessed against the scope and supported content, rather than treated as a clean bill of health for every file.
References: Google — About DLP for Drive · Google — Create DLP rules and test with audit-only actions · Google — Drive log events
4. Choose the smallest appropriate correction
Consider a fictional procurement folder shared with a supplier whose engagement has ended. Ask the owner whether the supplier still needs access, whether a group grants additional access, and whether another team relies on the same folder. If removal is appropriate, assign the change and record its completion rather than stopping at the reviewer’s approval.
For an active collaboration, the answer may be to retain a named recipient while removing an unnecessary broad link. For an exception, record the reason, approver, permitted audience, and review date. Prioritize exposure and sensitivity while preserving a clear route for legitimate business work.
- Validate the current audience and business purpose with the owner.
- Choose the permission or policy change that addresses the identified issue.
- Name the person who will apply changes that cannot be made directly.
- Retain the decision separately from the evidence that it was implemented.
5. Verify access and watch for retained permissions
Google documents an important shared-drive behavior: tightening an external-sharing restriction can prevent access while leaving the underlying file permission in place. If the restriction is later relaxed, that permission can grant access again. Record whether you removed a permission or only changed a policy that currently blocks it.
After a correction, inspect the source and validate access using approved test accounts where appropriate. Check that the intended audience lost access and that required collaborators can still work. Include relevant group membership and inherited access in that assessment. Retain the result, date, and any unresolved access path before closing the item.
References: Google — How file access works in shared drives
How Elba supports a Drive sharing review
Elba can connect supported Drive sharing findings to the asset, audience, and employee who understands the context. Eligible issues can expose direct permission removal or be distributed to an employee for review and a supported correction. Data Protection Playbooks help organize recurring findings around the conditions available in your workspace.
The Google Workspace directory connection is separate from the Google security-source grant used for supported Drive and OAuth security workflows. Connecting the directory does not enable Drive inspection by itself. Findings and actions depend on the enabled grant, workspace configuration, and object. Review the live scopes and validate representative findings before relying on coverage.
Drive sharing review checklist
Your checks stay on this page and reset when you reload it.
Common questions
Does DLP replace a review of sharing permissions?
No. Content rules, the current audience, and the business need answer different questions. Use them together to decide whether a particular exposure needs a correction.
Does blocking external sharing remove every existing permission?
Do not assume so. Google documents shared-drive restrictions that prevent access while retaining underlying permissions. Check the resulting source state and the effect of later policy changes.
How should a team handle legitimate external collaboration?
Verify the intended recipients with the owner, remove unnecessary access where appropriate, and document any exception with a review date. Blanket changes can disrupt work if the scope is not understood.
Does the Elba directory connection automatically inspect Drive?
No. Supported Drive security workflows require the separate Google security-source grant and the relevant capabilities to be enabled. Direct corrections are available only for eligible objects and permissions.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.