Google Drive sharing settings that protect your data

Where do you control Drive sharing?

You control Drive sharing in the Admin console, in the sharing settings for Drive and Docs. Settings apply to your whole organization by default, and you can set different rules for organizational units or groups. That lets you be strict with teams that handle sensitive data and more relaxed with everyone else.

Users can always share less than your policy allows, never more. That is the point: the Admin console sets the outer limit, so one rushed click cannot expose a file to the world. For how Drive fits with your other controls, see our Google Workspace security and HIPAA guide.

Should you allow sharing outside your organization?

Most organizations should allow external sharing with guardrails rather than turn it off entirely. Turning it off for everyone tends to push people toward personal accounts and email attachments, which are harder to control.

You have three broad options:

• Off: users can share only with people inside your organization. This suits teams that handle protected health information or similar data.
• Trusted domains only: users can share only with domains you add to an allowlist, such as a partner firm or your accountant.
• On, with warnings: users can share externally, and Drive warns them when a file is about to leave your organization.

If your team handles patient data, set these rules alongside the guidance in Is Google Workspace HIPAA compliant?.

What should the default link setting be?

The default for new files should be restricted to specific people or to your organization, not anyone with the link. Links get forwarded, pasted into chats, and saved in browser history, so public links are a common cause of accidental exposure.

In the Admin console you can set the default access for newly created files and decide whether users can make files available to anyone with the link at all. For most teams, a sensible setup is:

• New files default to restricted or organization-only access
• Public link sharing is off for sensitive teams and allowed with warnings elsewhere
• File owners use the option that stops viewers and commenters from downloading, printing, or copying sensitive files

How should you set up shared drives?

Shared drives need their own rules because they hold team files that belong to the organization, not to one person. When someone leaves, files in a shared drive stay put, which is a big reason to store team work there. Our guide to My Drive vs shared drives explains the difference for users.

In the Admin console you can decide:

• Who can create new shared drives
• Whether shared drive managers can override your default settings
• Whether people outside your organization can be added as members
• Whether people who are not members can be given access to individual files

Give each shared drive at least two managers, so access does not depend on a single person.

How do you find files that are already overshared?

You find overshared files by reviewing Drive activity and sharing in the Admin console's audit and reporting tools. The level of detail depends on your edition, and higher editions add tools such as data loss prevention rules.

If you recently migrated, pay attention to files that came across from OneDrive or SharePoint. Sharing permissions may have been carried over or changed during the move, as covered in OneDrive to Google Drive migration. Review externally shared files for sensitive teams, remove access that is no longer needed, and add this review to your security checklist.

Next step

If you want help choosing and applying the right sharing rules, our HIPAA setup service covers Drive configuration, or you can contact us.