The News, Explained

On November 5, Google announced a beta that automatically applies client-side encryption to Drive files. Administrators create rules that encrypt matching files in My Drive and shared drives at their existing URLs. Google Docs, Sheets, Slides, and supported Office files are among the targets. Reading the contents requires a decryption key from the organization’s external key service. Source Source

The launch specifies Enterprise Plus organizations with Assured Controls or Assured Controls Plus that have been admitted to the beta. The feature is off by default. Administrators must configure client-side encryption for Drive, a service that verifies users’ identities, and an external key service that supports automatic encryption. If Drive cannot reach that key service, the file remains unencrypted and the administrator receives an alert. Source Source

An existing link can still open even when features within the file change. According to Google’s admin guide, linked Forms and Apps Script automations attached to a file stop running and are removed from the primary file during conversion. If a sheet receiving survey answers is converted, for example, the old link can still open but the form connection is removed. The latest revision of a Google Doc, Sheet, or Slide deck is encrypted; earlier unencrypted revisions are deleted. Google exports removed content into separate encrypted files in the same location. Source

Files are temporarily locked for editing during conversion. Users who open an encrypted file in Docs, Sheets, or Slides see a notice that the administrator applied extra encryption. Administrators can preview the scope with an audit-only rule, which logs the matching files before encryption is switched on. Source Source

OYOPICK’s Take

Automatic encryption could spare staff the work of finding and handling sensitive files by hand. Before turning it on, we would look at the work that depends on those files as well as the file list. A shared sheet opening at its old address and continuing to receive survey answers are two separate checks. An audit-only rule can surface candidates so teams can start with documents that depend on linked forms and scheduled scripts. Source