44 Color-coded data domains (labels + IRM)

draft

A small badged label — three or four values, colour-coded, unambiguous — is published to Drive and made visible to the whole organization or to the users and groups that must see it. The label is then what a DLP rule keys on: 'Restricted' blocks external sharing, and IRM strips download, copy and print from viewers and commenters. The colour is documentation; the rule attached to it is the control.

Documentation: Get started as a classification labels admin

Caveats

A label is a colour until a DLP rule enforces it — and label-driven enforcement needs DLP for Drive — Enterprise Standard+, Frontline Standard+, Education editions or Enterprise Essentials Plus (Business Standard can create labels but not enforce on them).
Labels do not apply retroactively — existing files stay unlabelled until someone or a script labels them, so pair this with the public-share cleanup (№11).
IRM restricts download, copy and print; it is not DRM — printing from Preview mode is not blocked, and a screenshot, a photo of the screen or retyping defeats it.

Setup steps

Create the classification taxonomy as a badged label — few values, unambiguous, colour-coded. Three or four values, not ten.

open ↗

https://admin.google.com/ac/dc/labels · captured 2026-07-15

Security › Access and data control › Label manager

Label

'Sensitivity' (badged)

values

Public / Internal / Confidential / Restricted

Create classification labels for your organization
Publish the label and set its visibility — the entire organization (the default) or only certain users and groups. An unpublished label exists but does nothing.

open ↗

https://admin.google.com/ac/managedsettings/55656082996 · captured 2026-07-15

Security › Access and data control › Label manager

Status = Published; visible to entire organization
In the label's settings, tick the Applications checkboxes to make the label available in Drive; IRM is applied in the next step, as a DLP-rule action.

Security › Access and data control › Label manager

Label applications

Drive & Docs enabled
Attach a DLP rule to the label so that 'Restricted' actually blocks external sharing and applies IRM (the 'Disable download, print, and copy' rule action, where licensed) — the colour is documentation; the rule is the control.

open ↗

https://admin.google.com/ac/dp · captured 2026-07-15

Security › Access and data control › Data protection

Condition

Label 'Sensitivity' is 'Restricted'

Action

Block external sharing

Severity

High

Create DLP for Drive rules and custom content detectors Prevent users from downloading, printing, or copying files

Ongoing maintenance

requires a human Quarterly: review the label taxonomy against how documents are actually classified.

How to verify

Open a labelled document as a test user and attempt the restricted action (download/print/copy) — IRM must refuse it.

draft v0.1.3 Prevent edition Business Std+ (enforce: Ent Std+, Frontline Std+, Edu, Ent Essentials Plus) policy #15 · #4 ↗