Google Drive security for businesses: prevent data leaks
By Kike Gandia · Co-Founder & CEO, OSCP
Google Drive is where your company's information lives: contracts, customer data, intellectual property. A misconfigured share can expose all of that to anyone with a link. This guide explains how to control sharing and reduce the risk of a data leak.
The risk of anyone-with-the-link files
When a file is shared as anyone-with-the-link, it's no longer protected by authentication: anyone who gets the URL can access it, and those links can end up indexed or forwarded. It's one of the most common sources of accidental exposure of sensitive data.
Control external sharing
From the admin console you can restrict external sharing to trusted domains, enable warnings when sharing outside the organization and disable the creation of public links by default. It's one of the settings that most reduces the risk of a leak.
Permissions, ownership and shared drives
Files in My Drive belong to the employee and can be lost when they leave; shared drives keep ownership in the company's hands. Periodically reviewing permissions and moving critical information to shared drives improves control and continuity.
DLP for sensitive data
Data loss prevention (DLP) rules detect and block the exit of sensitive information —personal data, card numbers, credentials— before it's shared improperly. It's an essential layer for GDPR compliance and for protecting intellectual property.
A file’s access levels and what each one exposes
Before changing policy it is worth understanding exactly what each option in the sharing selector means, because the difference in risk between them is enormous.
| Access level | Who can open it | Main risk |
|---|---|---|
| Restricted | Only people added by name | The safest; requires managing invitations |
| Anyone with the link | Anyone who receives or discovers the URL | No authentication: the link gets forwarded, pasted into a chat or left in a history |
| Anyone in the domain with the link | Any employee, without asking | A single internal compromise reaches everything marked this way |
| Shared with a group | The group’s current members | Access changes on its own as the group changes and nobody reviews it |
| Shared drive | Members, according to their role | Correct for a company, but one excess manager role lets someone take everything |
The real jump in risk sits between the first two rows: the moment a file stops requiring an identity, access control stops existing.
How to find what is already exposed
Changing policy going forward does nothing about what was mis-shared over the years. For that you need the Drive audit logs and the admin console investigation tool, filtering on visibility-change events and on files shared outside the domain.
What is worth hunting for, in order: link-accessible files containing personal data, credentials or financial information; external collaborators who still have access to projects closed long ago; files owned by suspended accounts; and shared drives where an external party is listed as a manager. The investigation tool can also change the visibility of the results in bulk, so inventory and remediation can happen in the same pass. In large estates, the alternative is to walk the state with the Drive API and the Reports API.
FAQ
How do I find publicly shared files?
With the investigation tool and the Drive reports in the admin console. In a Workspace audit we specifically review external sharing and public links containing sensitive data.
What happens to a departing employee's files?
If they're in My Drive, they can be lost or orphaned when the account is deleted. That's why it's advisable to use shared drives for company information and to transfer data ownership as part of offboarding.
Does restricting external sharing break work with clients and suppliers?
Not if you use an allowlist of trusted domains rather than a blanket block. That model leaves intended collaboration intact —the domains you genuinely work with— and cuts the improvised kind, which is where leaks happen. Warnings when sharing outside the organization complement the policy well without blocking anyone.
What do you deliver in a Drive review?
An inventory of exposed files classified by access level, identification of those containing sensitive data, permissions inherited from projects that are long closed, the state of data ownership (what sits in My Drive that should be in a shared drive) and a proposed sharing configuration per organizational unit.
Can it be done without disrupting users?
Yes. The inventory is read-only against logs and reports, so nobody notices anything. What does need announcing is the policy change afterwards: if a file stops being public, whoever was using it via a link will lose access, so that is communicated in advance and rolled out in phases.
Are DLP rules available in every Workspace edition?
No. Data loss prevention for Drive is a feature of the higher editions, so check which edition you have before designing the policy. If it is not available, the realistic alternative is to lean on strict external sharing control, shared drives and periodic review of public links.
Related service
Google Workspace security audit