DLP for Drive FAQ

DLP for Drive supports a large number of predefined detectors. We’ll support more as DLP evolves.

No. We can't guarantee that all sensitive data will get caught and flagged. The DLP-detection system translates predefined templates into regular expressions and uses additional content parameters to determine the probability of a match. There might be false positives and negatives, which are triggered by many factors. In addition, not all file types are eligible for scanning and rule evaluation.

Yes. We attempt to scan all files anytime a rule is added or modified. However, not all file types are eligible for scanning. Scanning the files can take a few hours, a day, or longer depending on a variety of factors, including the number of files in the domain. 

Tip: If you add or modify a rule, DLP will scan the latest revision of previously uploaded files. This includes modifying a custom content detector that's used in a rule.

Yes. To help ensure sensitive content is detected, the scanning process sometimes scans documents twice. So the number of files affected by a rule change can vary between scans.

It can take up to 24 hours for a DLP policy to take effect.

File modification is the trigger for Drive DLP. In addition, Google Forms scans files uploaded as question submissions during the form-submission process.

There is no API access at this time.

If a user attaches a Drive file to email from "Insert files using Drive", DLP rules with the trigger "Message being sent" don't apply. However, if Google Drive sharing is also selected as trigger, those rules apply to the Drive files prior to email attachment. 

The stricter action will prevail. In this example, Social Security Numbers are blocked.

Use the security investigation tool. Go to Security investigation tool for details. 

The first 1 MB of each file or doc is scanned, except for comments (open or resolved), which aren't supported by DLP. For details, go to Is there a size limit on the Drive files that DLP can scan?

For more information on what types of files are scanned, go to Applications and file types scanned by DLP.

Yes, you can create an audit-only rule to test rules you create in the new DLP. This allows you to test a rule's potential impact. Like all rules, these rules trigger, but in this case, they take no action except to write results to the Rule audit report. Go to Use audit-only rules to test rule results (optional, but recommended). Also, go to Rule log events or the Security investigation tool for log event data. Both the Rule log events and the Security investigation tool show entries for triggered DLP rules.

Admins can receive up to 50 alerts per rule per day. They receive alerts until this threshold is met.

No. A scan is triggered if content is modified. Adding more recipients to an alert does not trigger a scan.

Yes, it's 1 MB. Here's how it works:

DLP converts Drive files into a scannable format, which includes file content and file format data, and then scans the resulting file. For a converted file larger than 1 MB, DLP scans only the first 1 MB of the converted file. Files that are larger than 50 MB aren't converted for scanning. Also, some files larger than 10 MB might not be converted. DLP will scan a file's title and labels for files of all sizes.

Yes. For files in My Drive, the DLP policy that applies to the file owner is in effect. For files in a shared drive, the shared drive is considered the file owner, and the DLP policy that applies to the shared drive is in effect.

Alerts are triggered when sensitive content, as defined by a DLP rule, is detected in a file. This can happen when either the file or the rule is created (if the content already exists). The actual sharing of the file doesn't trigger alerts. 

A "Triggering user" is the last user whose change to the document resulted in a DLP scan. It's only populated when the DLP scan happens due to a document change (for example, it isn't set when the scan happens due to a policy change).

Users get default messages from Drive.

Admins can write two policies using the same conditions, but each policy can have separate actions. For example, the first policy can block external access to content, while the second policy can apply IRM to the same content.

A client can't download a file that violates these policies.

No. This rule action is applied to view and comment roles.

Yes.

When the user opens the document to edit it. If the admin applied these restrictions using an action in a DLP rule when the user is already viewing the document, it won't take effect until the document reloads.

No.