Your guide to file sensitivity classification in Google Workspace

Your organization is dealing with more data than ever. How can we figure out how to protect sensitive information while keeping up with compliance rules?

Google Workspace has a handy feature called file sensitivity classification, which gives you more control over your data security right within the tools your teams use every day.
This guide explains file sensitivity classification in Google Workspace. We’ll cover what it is, how it works, and how AI (including Gemini and security) improves it. Plus, you’ll get practical steps to start.

What is file sensitivity classification in Google Workspace?

File sensitivity classification in Google Workspace uses “classification labels”. These are kind of like smart digital labels or tags you attach to your files in Google Drive and (still in Beta for some features) Gmail messages.

But they aren’t just basic tags; they’re actually a form of structured information — metadata — about each file. For example, a label could have a dropdown list like “Confidential”, “Internal”, or “Public”, or fields for dates, or even link to specific people.

The main goal of these labels is to help your organization get a better handle on organizing, finding, and applying specific security rules to all your digital content. When you classify files and messages, you’re essentially putting a sound information management plan into action. For instance, you could use a “Sensitivity” label to flag documents as “Confidential”. Once that’s done, you can set up rules based on that “Confidential” status, like automatically blocking it from being shared outside your company.

These classification labels are incredibly useful for a lot of everyday business needs:

• Managing company records properly
• Pinpointing sensitive data
• Making information easier to find
• Supporting specific workflows
• Reporting on and auditing how your data is being used and who has access

When labels are clear, it’s obvious just how sensitive a piece of data is and the right way to handle it. This is an important step toward really solid data protection.

How file sensitivity classification works in Google Workspace

The classification works by adding that extra layer of information (metadata) to your files or messages. Once a label is attached, Google Workspace can read this information and use it to enforce your security rules or launch other actions.

One of the most significant ways labels work is by applying policy to items in Drive and Gmail.

You can use a label as a condition within Data Loss Prevention (DLP) rules to help you meet compliance requirements. For example, if a file or message has information like customer addresses or ID numbers (Personally Identifiable Information, or PII), a DLP rule could automatically apply a “Confidential” label to it. That same rule could then stop that file from being shared externally or prevent the message from leaving your organization.

Now, you can apply labels manually, but the real power for handling lots of data comes from automatic labeling:

• Default classification: Your admins can set up policies so labels get applied automatically when a new file is created or when its ownership changes, often based on the file owner’s department. This method is great for general, lower-risk labels, like identifying which team created a file. While it looks at new files and ownership changes, it doesn’t scan the file’s actual content.
• DLP rules: As we touched on, DLP rules can automatically apply labels to both new and existing files by looking at their content or other things like file type. This is super handy for labels tied to data protection and how long you need to keep data. Plus, DLP-applied labels can be locked so users can’t just change them.
• AI classification: AI automatically applies labels to files, both new and old, after it’s been trained. More on this below.

Who gets to see what labels is up to the administrators, as they set the permissions. If someone doesn’t have permission for a certain label, they just won’t see it. You can find labels in Google Drive in the file’s “Details” or “Activity” sections, or right inside an open document. In Gmail, labels (often called “badges”) show up in your mailbox list and next to the sender’s name when you open a message.

Good to know: your organization can create up to 150 unique labels, and files can actually have several labels applied by users or different rules.

How AI enhances file sensitivity classification

Manual and rule-based labeling are useful. But what happens when you’re dealing with the heaps of data most organizations create today? AI-powered classification for Google Drive can help. It uses artificial intelligence to automatically find and label sensitive files with impressive accuracy, even when dealing with huge volumes of data.

How AI training works

The AI models are trained using your organization’s very own files and data. This means the AI learns what you consider sensitive, based on your specific needs. The process usually looks something like this:

• Preparation: You create the classification label you want the AI to use (for example, “Highly confidential”). Then, you pick people in your organization who really understand your data policies to help train the AI.
• Training: The selected group of people applies a special “training label” to a set of example files — files that are good representations of what the AI should learn to identify. The AI model learns from these examples.
• Automatic classification: Once the model is trained and meets a certain performance score, administrators can enable auto-apply. The model then begins evaluating new and existing files owned by licensed users and applies the appropriate label.

Gemini AI and your data security

It’s really important to know that these models are trained specifically on your organization’s data. Google is very clear on this: the data you use to train these custom classification models remains your data. It’s not used to train models for other customers, nor is it used for Google’s general AI models (like the public version of Gemini).

This commitment to data privacy is a core part of Google’s broader AI principles, making sure your information is handled responsibly and securely, all within your Workspace environment. Essentially, the AI helps classify your content based on your definitions of what’s sensitive, and that know-how stays with you.

It’s also good to know how these AI-applied labels interact with other methods:

• AI-applied labels can be reviewed and modified by end users. When a user accepts or modifies a label, the AI model won’t change it again.
• If a file was previously labeled manually by a user, the AI model will not modify that label.
• DLP rules can be set up to override labels from users or AI if highly sensitive data is found.
• AI classification labels will take precedence over any default classification labels.

Practical steps to implement file sensitivity classification

Here are key steps for business leaders to consider:

1. Identify and classify your data: Before creating labels, understand what sensitive information your organization has. Identify your legal, regulatory, and contractual requirements for data protection. Based on this, define a clear information classification scheme (e.g., Public, Internal, Confidential, Highly Confidential).

2. Design your label taxonomy: In the Google Admin console, create classification labels that map to your information scheme. Decide on the structure for each label — simple tag, or with specific fields (like a “Classification” field with options). Consider using a hierarchy for more flexibility. You can create up to 150 labels.

3. Define label visibility and permissions: Determine which users or groups should be able to see, apply, or edit specific labels. This ensures that labels are only visible and applicable where appropriate.

• Manual: Motivate your team to apply labels as they create or work with files. Consider using “required fields” on labels to prompt users to provide classification information.
• Default classification: Use this for general labeling of new files or files changing ownership based on the owner’s team or department. This works best with labels that have option lists.
• DLP rules: This is critical for automatically applying labels when sensitive content is detected (like financial data or health records). Use DLP to enforce data protection and retention policies. DLP rules apply labels to new and existing files.
• AI classification: Use AI for large-scale, precision-based automatic classification of both new and existing files based on learned patterns in your data. Identify designated labelers to train the model and understand the data quality needed for effective training.

5. Set up policy enforcement: Integrate classification labels with DLP rules to automate actions like restricting external sharing or downloads based on a file’s classification. Labels can also trigger retention policies in Google Vault.

6. Educate your users: Train your team on what the different labels mean, why classification is so important (for security and compliance), and how to apply labels manually if necessary or review AI-suggested labels.

7. Pilot, test, and refine: Consider rolling out classification and policies in phases. For automated methods like DLP, starting in monitoring mode can help you understand the impact before enforcing restrictions.

8. Monitor and audit: Regularly check the system reports and audit logs. These will show you how labels are being applied and if your policies are working as intended. It’s also good practice to do internal checks to ensure your controls are effective. And, of course, review and update your classification scheme and policies as your business evolves.

Protecting your company’s important information is essential. File sensitivity classification in Google Workspace helps you do just that. It’s a straightforward way to keep your data safe and meet legal requirements. Contact Revolgy today to find out how we can help you get started.