How To Restrict File Access In Google Workspace

In today’s remote and distributed workforce, employees often share documents across cloud collaboration platforms without thinking about the consequences. However, this can lead to unintentional security risks that will take IT and security teams lots of unnecessary time to address. 

Being able to restrict who has access to your company’s sensitive documents in Google Workspace is a vital part of document security. You want to control who can copy, print, or download certain files or keep editors from resharing content with people who should not have access. This helps bolster your security posture and mitigate access risks that come from accidental or malicious oversharing. 

We’ll go over how to best protect your files by restricting access in Google Workspace. Some of these actions can be taken by all users with a Google Workspace account, not only administrators. 

In this article, we’ll learn:

1. How to prevent editors from re-sharing content and changing access permissions
2. How to stop files from being copied, printed, or downloaded in My Drive
3. How admins can restrict files from being copied, printed, or downloaded in shared drives 

How to prevent Editors from re-sharing and changing access permissions

What is it?

If a user has a file that they own in Drive that has sensitive content, they can prevent anyone with Editor permissions from sharing it again and changing its access permissions. You can set it so that only the owner can share or set permissions. 

Why it matters

Under normal circumstances, if a user is sharing with someone who has Editor access, they can easily change the sharing permissions for that file. This leads to Access-Risk, and the owners of the files now have limited control over who is sharing their documents or setting their permissions. Preventing editors from having re-sharing and access permission change controls is a best practice if users are sharing documents with extremely sensitive content but is less applicable to other types of files. 

How to do it

1. Open the homescreen for Drive, Docs, Sheets, or Slides.
2. Select one or more files to limit.
3. Click “Share” or the “Share person+” icon

4. At the top, click the “Settings” icon.

5. Uncheck “Editors can change permissions and share.”

6. Click “Done.”

How to prevent a file from being copied, printed, or downloaded

What is it?

Users can prevent those with Commenter and Viewer access from downloading, printing, or copying files. Whenever a Commenter or Viewer tries this with a shared file, those options are grayed out and unavailable to them. 

Why it matters

We understand there are plenty of workarounds for this method, however, it helps prevent accidental downloading and copying of files that do not need to be saved to people’s company or personal computers. It adds another layer of protection to sensitive files and prevents human error but wouldn’t do much to deter someone with serious malicious intent. 

How to do it in My Drive

1. Open the homescreen for Drive, Docs, Sheets, or Slides.
2. Select one or more files to limit.
3. Click “Share” or “Share person+” icon.
4. At the top, click “Settings .”
5. Uncheck “Viewers and commenters can see the option to download, print, and copy.”
6. Click “Save” > “Done.” How admins can prevent files from being copied, printed, or downloaded in shared drives 

1. From the Admin console Home page, go to “Apps”> “Google Workspace”> “Drive and Docs.”
2. Select “Manage shared drives.”
3. Hover over a shared drive, and click the “Settings” button.
4. Uncheck “Allow managers to modify shared drive settings” to keep people from overriding the default settings for the shared drive.
5. Check or uncheck boxes to modify any of the following options:
   • Sharing outside your organization—Allow or prevent external people from accessing files in the shared drive.
   • Sharing with non-members—Allow or prevent shared drive members from giving non-members access to files in the shared drive.
   • Download, copy, and print—Allow or prevent commenters and viewers from downloading, copying, and printing files in the shared drive.

Being able to restrict access to sensitive information is a tool that any employee can use in their Google Drive. Employees can prevent editors from resharing or changing access permissions or prevent a file from being copied, printed, or downloaded. Admins can further limit access by putting restrictions on shared drives. Although there are workarounds to these methods, preventing these actions adds one extra layer of protection to your company documents. To gain more comprehensive visibility and control over your files, you can use a Cloud Document Security system.