How to Implement Compliance Rules in Google Workspace (G Suite)

Are you concerned about HIPAA compliance or preventing employees from accidentally sharing sensitive information over email? Do you need to implement a data loss prevention (DLP) policy for your organization?

Even when employees understand that sensitive information, such as Social Security numbers, should not be sent through email, mistakes can still happen. Fortunately, Google Workspace (formerly G Suite) includes compliance tools that can help protect your organization’s data.

By implementing Gmail compliance rules, you can configure Gmail to automatically scan incoming and outgoing messages, including attachments. You can also set rules to quarantine messages that contain sensitive information so they can be reviewed before being delivered.

Here’s a quick guide to setting up a compliance rule, based on Google’s instructions.

Set Up a Compliance Rule

First, sign in to your Google Workspace Admin console and follow these steps:

1. Sign in to the Admin console.
2. Go to Apps > Google Workspace > Gmail > Compliance.
3. In the Compliance section, find Content compliance and click Configure or Add another rule, depending on your Admin console interface.
4. In the Add setting window, enter a short description for the rule, such as Social Security Number detected.
5. Under Email messages to affect, select Outbound to prevent emails containing Social Security numbers from being sent outside your organization. You can also select Internal – sending if you want the rule to apply to internal messages.
6. Under Add expressions, click the drop-down menu and select If ANY of the following match the message.
7. Under Expressions, click Add.
8. Select Predefined content match.
9. Click Predefined content match again and select United States – Social Security Number.

You can then adjust the detection settings based on your organization’s needs.

Optional Detection Settings

You can set a Minimum match count to determine how many Social Security numbers must appear in an email before the rule is triggered.

For example, if you leave the value at 1, an email containing a single Social Security number will trigger the rule.

You can also select a Confidence threshold of High or Medium. This setting indicates how likely the detected content is to match the criteria you specified.

For well-defined patterns, such as Social Security numbers, Google may be able to detect the information with a high level of confidence.

Once your settings are configured, click Save.

Quarantine Messages

Next, you can configure Gmail to quarantine messages that match your compliance rule.

1. Under If the above expressions match, select Quarantine message.
2. Click Add setting, then click Save.
3. Review the Content compliance section to confirm that your new rule has been added.

Quarantining messages gives administrators an opportunity to review potentially sensitive emails before they are delivered.

Check Quarantined Emails

After messages have been quarantined, administrators can review them through the Quarantine Manager.

1. Open the Quarantine Manager.
2. Click All quarantines to view the quarantined messages.
3. Select an email to review its contents.
4. Check the box next to one or more messages and select Allow or Deny.

If you select Allow, the email will be delivered.

On the other hand, if you select Deny, the email will not be delivered, and the sender will receive a notification that the message could not be delivered.

Protect Your Organization’s Data

Compliance rules can provide an additional layer of protection against accidental sharing of sensitive information. By automatically identifying specific types of data and quarantining messages for review, Google Workspace admins can create a more secure email environment.

However, compliance rules should be part of a broader security and compliance strategy. Organizations should also consider their regulatory requirements, internal policies, employee training, and other Google Workspace security controls.

If you have questions about setting up compliance rules or protecting sensitive information in Google Workspace, contact the HiView team. We’re happy to help.