Google Workspace now lets administrators automatically encrypt sensitive files in Docs, Sheets, Slides, and Drive without staff having to do anything manually. This new beta feature—Policy-Based Enforcement—means your organisation can protect confidential data at scale, satisfy compliance requirements like HIPAA and ITAR, and stop relying on employees to remember to encrypt things themselves.
If you've ever worried about sensitive contracts, financial spreadsheets, or client data sitting unprotected in your company's Drive, this update directly addresses that problem.
What does automatic client-side encryption actually do?
Client-side encryption (CSE) in Google Workspace means your organisation controls the encryption keys—not Google. Until now, users had to manually create encrypted copies of files and then delete the originals. That's a lot of steps, and frankly, people forget.
With Policy-Based Enforcement, admins set rules in the Google Workspace Admin console. When a file matches those rules (say, anything containing specific keywords or stored in certain shared drives), encryption happens automatically. The file keeps its original URL, so links don't break and workflows stay intact.
Your team sees a simple notification banner when they open an encrypted file. That's it. No extra clicks, no training headaches.
Which file types and locations are covered?
The beta supports:
- Google Docs, Sheets, and Slides
- Microsoft Office files (.docx, .xlsx, .pptx)
- PDFs and images
- Files in both personal "My Drive" and shared drives
This broad coverage means you're not limited to native Google formats—a genuine concern for organisations that work with external partners sending Office documents.
How do admins monitor what's happening?
Two tools help you stay on top of things:
- Security Investigation Tool (SIT) – Track encryption activity, see which files were encrypted, and audit outcomes.
- Alert Centre notifications – Get proactive alerts if your external Key Access Control List Service (KACLS) goes down or has connectivity issues.
This visibility matters. You can't manage what you can't see, and compliance audits require documentation.
What do you need to enable this feature?
Here's the catch: this isn't available to all Workspace customers. You'll need:
- Google Workspace Enterprise Plus
- The Assured Controls or Assured Controls Plus add-on
- Beta enrolment via Google's application form
Once approved, Google provides onboarding documentation. The feature is off by default, so nothing changes until you configure it.
For organisations already using Google Workspace through Blue Chip Technologies Ltd., we can help you assess whether Assured Controls makes sense for your compliance needs and walk you through the beta application.
Frequently asked questions
Does automatic encryption change the file's sharing link?
No. Encryption happens "in place," so the original URL stays the same. Bookmarks and shared links continue working.
Will employees need training to use encrypted files?
Minimal. Users see a banner explaining that their admin applied additional encryption. They don't need to do anything differently to view or edit the file (assuming they have access through your key management setup).
Can I encrypt files retroactively?
Yes. Policy-Based Enforcement scans existing files that match your rule conditions, not just new uploads.
Is this available outside the beta?
Not yet. Google hasn't announced a general availability date, so beta enrolment is currently required.
Ready to tighten data protection in your organisation?
If your business handles sensitive client information, regulated data, or confidential IP, automatic encryption removes a significant gap in your security posture. Blue Chip Technologies Ltd. helps organisations worldwide set up and manage Google Workspace—including advanced security features like client-side encryption.
Get in touch to discuss your requirements:
