Prevent data leaks from Chat messages & attachments

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Under Protect your sensitive content, click Create rule.
4. Add the name and description for the rule, such as Block when sharing SSN in chat.
5. In the Scope section, choose Apply to all <domain.name> or choose to search for and include or exclude organizational units or groups the rule applies to.
6. Click Continue.
7. For Google Chat select Message sent and File uploaded (for attachments).
8. Click Continue.
9. In the Conditions section, click Add Condition and select the following values:
   1. Content type to scan—All content (note that All content is the only content type available if you select Google Chat, no matter what other apps are selected)
   2. What to scan for—Matches predefined data type (recommended)
   3. Select data type—United States - Social Security Number.
   4. Likelihood Threshold—High. The confidence threshold for the condition. This is an extra measure used to determine whether messages trigger the rule action.
   5. Minimum unique matches—1. The minimum number of times a unique match must occur in a message or attachment to trigger the action.
   6. Minimum match count—1. The number of times the content must appear in a message or attachment to trigger the action. For example, if you select 2, content must appear at least twice in a message to trigger the action. 
10. Click Continue. In the Actions section, under Chat, select Block message. Also select when the action should apply. For this example, select External conversations and Internal conversations. Leave Spaces, Group chats, and 1:1 chats selected.
11. (Optional) In the Alerting section:
    • Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard. 
    • Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
12. Click Continue to review the rule details. The action for Chat is to block message for external and internal conversations.
13. Choose a status for the rule:
    • Active—Your rule runs immediately
    • Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to SecurityAccess and data controlData protectionManage Rules. Click the Inactive status for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
14. Click Create.

Changes can take up to 24 hours but typically happen more quickly. Learn more

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Under Protect your sensitive content, click Create rule.
4. Add the name and description for the rule, such as Block when sharing a passport number in Chat and Drive.
5. In the Scope section, choose Apply to all <domain.name> or choose to search for and include or exclude organizational units or groups the rule applies to.
6. Click Continue.
7. For Google Drive select File created, modified, uploaded, or shared. For Google Chat select File uploaded only.
8. Click Continue.
9. In the Conditions section, click Add Condition and select the following values:
   1. Content type to scan—All content (note that All content is the only content type available if you select Google Chat, no matter what other apps are selected).
   2. What to scan for—Matches predefined data type (recommended)
   3. Select data type—United States Passport
   4. Likelihood Threshold—High.  The confidence threshold for the condition. This is an extra measure used to determine whether messages trigger the action.
   5. Minimum unique matches—1. The minimum number of times a unique match must occur in a document to trigger the action.
   6. Minimum match count—1. The number of times the content must appear in a message to trigger the action. For example, if you select 2, content must appear at least twice in a message to trigger the action.
10. Click Continue. In the Actions section:
    1. Under Google Chat, select Block message. Also, select when the action should apply. For this example, deselect Internal conversations, and leave External conversations selected. You can also select which types of chats to apply the rule to.
    2. Under Google Drive, select Block external sharing.
11. (Optional) In the Alerting section:
    • Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard. 
    • Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
12. Click Continue to review the rule details. The action for Chat is to block content for external conversations only. The action for Drive is to block external sharing.
13. Choose a status for the rule:
    • Active—Your rule runs immediately
    • Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to SecurityAccess and data controlData protectionManage Rules. Click the Inactive status for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
14. Click Create.

Changes can take up to 24 hours but typically happen more quickly. Learn more

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Under Protect your sensitive content, click Create rule.
4. Add the name and description for the rule, such as Log when sharing names in chat or Chrome.
5. In the Scope section, choose Apply to all <domain.name> or choose to search for and include or exclude organizational units or groups the rule applies to.
6. Click Continue.
7. For Chrome, select File uploaded only. For Google Chat select File uploaded only.
8. Click Continue.
9. In the Conditions section, click Add Condition and select the following values:
   1. Content type to scan—All content (note that All content is the only content type available if you select Google Chat, no matter what other apps are selected).
   2. What to scan for—Contains text string
   3. Enter contents to match—SpiderWeb
10. Click Add condition to add an OR condition, and select the following values:
    1. Content type to scan—All content 
    2. What to scan for—Contains text string
    3. Enter contents to match—SpdW 
11. Click Continue. In the Actions section, under Chrome and Chat, select Audit only. Also, for Chat, select when the action should apply. For this example, select both External conversations and Internal conversations.
12. (Optional) In the Alerting section:
    • Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard. 
    • Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
13. Click Continue to review the rule details. Under Action, note that the action for Chrome is audit only, and the action for Chat is also audit only, and mentions that the action occurs for external and internal conversations.
14. Choose a status for the rule:
    • Active—Your rule runs immediately
    • Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to SecurityAccess and data controlData protectionManage Rules. Click the Inactive status for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
15. Click Create.

Changes can take up to 24 hours but typically happen more quickly. Learn more

In this example, you create a custom detector that lists project-sensitive terms. Then, you’ll use this custom detector as a condition in a DLP rule.

Create the detector

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlData protection.
3. Click Manage detectors.
4. Click Add detector, then Word list.
5. In the Add word list window:
   1. Add the name (such as Sensitive terms) and a description. 
   2. Add a comma-separated list of your sensitive terms. Note that capitalization and symbols are ignored, and only complete words are matched. Words in word list detectors must contain at least 2 characters that are letters or digits. 
6. Click Create. Now, you can use the custom detector in a rule condition.

Use the custom detector in a rule

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Under Protect your sensitive content, click Create rule.
4. Add the name (such as Sensitive terms to warn users about) and a description for the rule. 
5. In the Scope section, choose Apply to all <domain.name> or choose to search for and include or exclude organizational units or groups the rule applies to.
6. Click Continue.
7. For Google Chat select Message sent and File uploaded.
8. Click Continue.
9. In the Conditions section, click Add Condition and select the following values:
   • Content type to scan—All content (note that All content is the only content type available if you select Google Chat, no matter what other apps are selected).
   • What to scan for—Matches words from a word list
   • Word list name—Sensitive terms
   • Match mode—Match any word
   • Minimum total times any word detected—1
10. Click Continue. In the Actions section, under Chat, select Warn users. Also, for Chat, select when the action should apply. For this example, select External conversations and Internal conversations.
11. (Optional) In the Alerting section:
    • Choose a severity level (Low, Medium, or High) for how an event triggered by this rule is reported in the security dashboard. 
    • Choose whether an event triggered by this rule should also send an alert to the alert center. Also choose whether to email alert notifications to all super administrators or to other recipients.
12. Click Continue to review the rule details. Under Action, note that the action for Chat is Warn users, and mentions that the action occurs for External and Internal conversations.
13. Choose a status for the rule:
    • Active—Your rule runs immediately
    • Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to SecurityAccess and data controlData protectionManage Rules. Click the Inactive status for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
14. Click Create.

Changes can take up to 24 hours but typically happen more quickly. Learn more

A rule template provides a set of conditions that cover many typical data protection scenarios. Use a rule template to set up policies for common data protection situations.

This example uses a rule template to block sending a chat message, uploading a file to a chat, or sharing a Drive file, if the message or file contains US personally identifiable information (PII). 

Before you begin, sign in to your super administrator account or a delegated admin account with these privileges:

• Organizational unit administrator privileges. 
• Groups administrator privileges.
• View DLP rule and Manage DLP rule privileges. Note that you must enable both View and Manage permissions to have complete access for creating and editing rules. We recommend you create a custom role that has both privileges. 
• View Metadata and Attributes privileges (required for the use of the investigation tool only): Security CenterInvestigation ToolRuleView Metadata and Attributes.

Learn more about administrator privileges and creating custom administrator roles.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Click Templates.
4. On the Templates page, click Prevent PII information sharing (US).
5. In the Name section, accept the default name and description of the rule or enter new values.
6. In the Scope section, search for and select the organizational units groups the rule applies to.
7. Click Continue. Under Apps, the following options are preselected:
   • for Google Chat, the Message sent and File uploaded boxes are checked.
   • For Google Drive, File create, modified, uploaded or shared is selected. 
8. Click Continue.
9. Review the default preselected conditions for the PII rule template:
   • Content type to scan—All content (note that All content is the only content type available if you select Google Chat, no matter what other apps are selected).
   • What to scan for—Matches predefined data type (recommended)
   • Select data type—Several data types, including Social Security Number, Driver's License Number, and United States Passport number.
   • Likelihood Threshold—Very high. The confidence threshold for the condition. This is an extra measure used to determine whether messages trigger the action.
   • Minimum unique matches—1. The minimum number of times a unique match must occur in a document to trigger the action.
   • Minimum match count—1. The number of times the content must appear in a message to trigger the action. For example, if you select 2, content must appear at least twice in a message to trigger the action.
10. Click Continue to review the default Actions selected for the PII rule template (for Chat, Block message; for Drive, Block external sharing). 
11. Click Continue to review the rule details.
12. Choose a status for the rule:
    • Active—Your rule runs immediately
    • Inactive—Your rule exists, but does not run immediately. This gives you time to review the rule and share it with team members before implementing. Activate the rule later by going to SecurityAccess and data controlData protectionManage Rules. Click the Inactive status for the rule and select Active. The rule runs after you activate it, and DLP scans for sensitive content.
13. Click Create.

Changes can take up to 24 hours but typically happen more quickly. Learn more

As your organization's administrator, you can add a message to display to your users when a rule is triggered. You can customize the message to help users understand and fix the violating content and then block the message or warn them. 

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. For Classify and protect your sensitive content, click Create rule.
4. Click Name and enter a name for the rule.
   (Optional) To enter a description for the rule, click Description and enter it. 
5. For Scope, choose an option:
   • To apply the rule to your whole organization, select All in domain.name.
   • To apply the rule to specific organizational units or groups, select Organizational units and/or groups and include or exclude the organizational units and groups.
6. Click Continue.
7. For Apps and Google Chat, choose one or more of the following options:
   • To apply the rule to messages, check the Message sent box.
   • To apply the rule to attachments, check the File uploaded box.
8. Click Continue.
9. (Optional) To add a condition:
   1. Click Add Condition. For Google Chat, All content is the only option. 
   2. Click What to scan for and complete the needed attributes for the type of scan.
      
      If you create a DLP rule with no condition, the rule applies the specified action to every Chat message and all uploaded files (depending on whether you select messages, file attachments, or both when creating the rule).
10. Click Continue. 
11. Click Action and choose an option:
    • To warn users, select Warn users.
    • To block the message, select Block message. 
12. Select when to apply the rule and check the Customize message box.
13. Enter your customized message. You can create messages up to 300 characters long and insert links. An inserted URL counts toward the character limit of the message.
14. (Optional) To choose a severity level for how to report events triggered by this rule in the Admin console, for Alerting, select Low, Medium, or High.
15. (Optional) To send an alert to the alert center when an event is triggered by the rule, check the Send to alert center box and to send a notification about the alert to all super admins, check the All super administrators box. You can enter other email recipients as well for notifications.
16. Click Continue and review the rule details. 
17. Choose a status for the rule:
    • Active—Your rule runs immediately.
    • Inactive—Your rule exists but does not run immediately. This option gives you time to review the rule and share it with team members before implementing. To activate the rule later, in the Admin console, go to SecurityAccess and data controlData protectionManage Rules, change the status to Active, and click Confirm. 
18. Click Create.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. On the Admin console Home page, go to SecurityAccess and data controlData protection.
3. Under Data protection settings, click Optical character recognition (OCR). The default state is ON. If OCR is OFF, then select OFF and slide it to ON.
4. Click Save.  This turns on OCR for data protection rules that apply to Google Chat.

Note: Once turned on, the OCR setting will apply to all DLP for Chat rules. It can’t be applied selectively to specific rules.

You can verify that OCR is turned on when creating a data protection rule.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. On the Admin console Home page, go to Rules.
3. Under Protect your sensitive content, click Create a rule.
4. Enter a name and description for the rule. 
5. In the Scope section, choose Apply to all <domain.name> or choose to search for and include or exclude organizational units or groups the rule applies to.
6. Click Continue.
7. Under Apps, for Google Chat, check File uploaded.
8. Click to check whether OCR is turned on. If OCR is OFF, then select OFF and slide it to ON.
9. Click Continue to finish creating the rule. For help on creating rules, see DLP for Chat rule examples, above.