On 5 November, Google announced a beta that applies client-side encryption through rules to matching files in My Drive and shared drives, including Docs, Sheets, Slides and supported uploads. Conversion keeps the URL. It is off by default; the launch requires Enterprise Plus with Assured Controls or Assured Controls Plus and beta enrollment and allowlisting. Launch details.
For an administrator, the useful question is which working process can safely cross that boundary. Review the rule as a change to a team’s files, rather than treating a green policy switch as the finish line.
Check the file’s dependencies
The administration guide also lists Education editions; confirm eligibility. CSE must be configured for the target scope, with a key service supporting systemwrap.
Conversion permanently removes bound Apps Script automations and linked Forms from the primary file. Previous unencrypted revisions are deleted; removed content is exported as encrypted takeout files. For Docs, Sheets and Slides, the latest revision is encrypted and comments retained; third-party-file comments are removed. Conversion effects.
Before a pilot, ask the file owner what would count as a broken workflow. A document may be only one step in a process. Write down who consumes its output, which jobs depend on it, and how the owner will check the result.
Define completion before rollout
Google recommends audit-only rules first. If the key service is unreachable, files remain unencrypted. Resolve errors, rescan, and confirm the Encryption change applied event says Succeeded. Operational guidance.
A practical review plan:
- Agree on a small scope. Name the owners and the business process being evaluated.
- Record the expected outcome. Specify who should be able to work with the converted file and which tasks must still work.
- Assign failure handling. Give someone responsibility for reviewing incomplete work and recording the next action.
- Make expansion conditional. Require both technical evidence and the owner’s functional checks before including more files.
These are proposed review steps, not results from a deployment we tested. Encryption policy does not, by itself, establish legal compliance; that assessment belongs with the organization’s requirements and advisers.