Now available in beta: Automatically apply client-side encryption (CSE) to confidential Docs, Sheets, Slides, and Drive files

Administrators can automatically apply client-side encryption (CSE) to control access to sensitive files across their organization using Policy-Based Enforcement, now available in beta.

Previously, end users were required to manually create encrypted copies of existing files and remember to delete the unencrypted originals. With Policy-Based Enforcement, CSE integrates directly with the Google Workspace Rules Engine, enabling admins to set up customizable rules that seamlessly layer onto existing data governance strategies and applies CSE to the most sensitive, private data.

Encryption is enforced “in place”, preserving the file’s original URL. This provides organizations with an authoritative, scalable control to protect critical data and satisfy rigorous compliance mandates, including ITAR, EAR, and HIPAA.

End-user notification of admin led additional encryption.

Key capabilities in beta:

• Comprehensive file and location support: Policy-Based Enforcement automatically encrypts files matching rule conditions across both my Drive and shared drives. Policy-Based Enforcement scans all file types supported by Workspace Rules, including Google Docs, Sheets, and Slides, Microsoft Office files (.docx, .xlsx, .pptx), and additional non-native formats such as PDFs and images.
• End-user transparency: When users open a file encrypted by an administrative policy, they receive an in-product contextual notification informing them of the update.
• Audit logging and proactive alerting: Admins can monitor encryption activity and outcomes within the security investigation tool (SIT) and will receive alert center notifications if their external Key Access Control List Service (KACLS) is unreachable or experiencing issues.

Getting started

• Admins:
• Enrollment required: This feature is available in beta to eligible customers. To request access, complete the Policy-Based Enforcement beta Application with your domain information. Customers must have Assured Controls or Assured Controls Plus licenses to enable the feature.
• Configuration: This feature is OFF by default and can be configured in the Admin console. Once allowlisted, eligible domains will receive onboarding and configuration documentation.
• End users: There is no end-user setting for this feature. When opening a file that has been encrypted by a rule, users will see an informational banner indicating that additional encryption was applied by their administrator.

Rollout pace

• Rapid Release and Scheduled Release domains: Available now for eligible customers enrolled in the Policy-Based Enforcement beta allowlist

Availability

• Available to Google Workspace customers with the Google Workspace Assured Controls or Assured Controls Plus add-on to Enterprise Plus who have enrolled in the Policy-Based Enforcement beta.

Resources

• Google Workspace Admin Help: About client-side encryption
• Google Workspace Admin Help: Apply client-side encryption using data protection rules (beta)
• Google Docs Editors Help: Get started with encrypted files in Drive, Docs, Sheets & Slides
• Beta Program Registration: Policy-Based Enforcement beta application