Using Google Drive Encryption: A Guide

Data is big business, both for the companies that generate it and for hackers who want to access it for ransomware or simply sell it to the highest bidder. In fact, the problem of corporate piracy is only getting worse. In 2022, 1,802 companies suffered data breaches, affecting more than 422 million people in the US alone.

Those statistics may make you wonder how strong the encryption is on your company’s Google Drive account. After all, encryption is the shield that deflects nefarious attempts to access your data, so it needs to be strong. This article explains how Google Drive encryption works and what you can do to strengthen it.

Google Drive Standard Encryption

Google automatically encrypts every file you upload to Google Drive. It also encrypts any files you create within the Google Drive package, such as those created with Google Sheets, Docs, or Slides.

The company uses AES 256-bit encryption for this purpose, which stands for “Advanced Encryption Standard (AES) 256”. It pides any information it passes into blocks, which it encrypts using a cipher so that the text is unreadable to anyone who does not have the key to the information, that is, people who do not have access to your document.

Google implements this encryption “in transit,” meaning it is applied instantly when you upload or create a file to Google Drive.

How to apply client-side encryption to Google Drive

For many, using 256-bit AES encryption is sufficient. It is a military-grade encryption standard that some claim is impenetrable, at least to hackers using brute force methods. But that doesn’t eliminate the possibility that someone could gain access to the key needed to decrypt your Google Drive files, such as a disgruntled employee who still knows the password. Which means you may want another layer of encryption.

Google Drive provides this with client-side encryption.

With client-side encryption, it encrypts Google Drive files locally, complementing the protection of the service’s standard 256-bit AES encryption. By enabling client-side encryption at the administrative level, you give your users the option to decide whether to encrypt their files locally.

You must have a Google account with “super administrator” privileges to enable client-side encryption. Assuming you do, follow these steps:

1. Log in to your Google Administrator console.
2. Locate the “Menu” (indicated by three horizontal lines) and select “Security.”
   
3. Click “Data and Access Control,” followed by “Client-Side Encryption.”
   
4. Scroll to “Applications” and turn on encryption for required Google Drive apps.

If you already have client-side encryption configured, specifically on your primary organizational unit, your Google Admin console may ask you if you want to override that setting for the group you’re working in. Select “Override” to do this, choosing “Inherit” to have the group inherit the settings it has in its parent group or “Save” to override the parent group’s settings with your new settings.

Note: Changes may take up to 24 hours to take effect. Once client-side encryption is enabled, your users can create, copy, upload, and modify encrypted documents through Google Drive.

Create encrypted files in Google Drive

With client-side encryption enabled at the administrator level, users in your organization can encrypt files as they create them using two methods.

Encrypt at Google Drive level

Follow these steps to encrypt files via Google Drive:

1. Log in to your Google Drive account.
   
2. Click “New +” in the upper left corner of the screen.
   
3. Move your cursor over the arrow next to the Google Docs, Slides, or Sheets file you want to encrypt.
   
4. Select “Blank encrypted document/presentation/spreadsheet.”
   
5. Create in your window “New encrypted document”.
   

Encrypt at the Google Docs, Slides, or Sheets level

You can also encrypt documents, slides, and spreadsheets without signing in directly to your Google Drive account:

1. Open a Google Docs, Slides, or Sheets file.
   
2. Select “File” at the top of the screen.
   
3. Highlight “New” and select “New Encrypted Document/Presentation/Spreadsheet.”
   

Copy encrypted files to Google Drive

You can copy encrypted files from Google Drive as long as you’re signed in to an account that has access to client-side encryption:

1. Double-click or right-click the file you want to copy.
   
2. Choose “Make a copy.”
   

Copy is also versatile, allowing you to add encryption to Google Drive files that don’t already have it or remove encryption from those that do. After double-clicking or right-clicking your file, select “Make a decrypted copy” to remove client-side encryption from the file, or “Make an encrypted copy” to add encryption to files that don’t have it.

Upload an encrypted file to Google Drive

Enabling client-side encryption allows users to upload and encrypt previously unencrypted files from their local devices:

1. Sign in to your Google Drive account.
   
2. Select “New +” in the navigation bar.
   
3. Highlight “Upload File” and select “Encrypt and Upload File.”
   
4. Choose the file you want to upload from your device directory.
   

Add encryption to an existing Google Drive document

You may have existing Google Doc, Slide, or Sheet documents that you want to further protect with client-side encryption. The process is simple, although there are some caveats. Follow these steps to encrypt your document:

1. Open the Google document, slide, or spreadsheet.
   
2. Choose “File” in the navigation bar, followed by “Make a copy.”
   
3. Select “Add additional encryption.”
   

As for caveats, there are some features in Google Docs that need to be removed or they will lose their dynamic features when you encrypt them.

Features that encryption removes from the document include:

• Comments
• Suggestions
• Electronic signature fields
• Any protected range

Regarding the loss of dynamism, the following characteristics become static after encryption:

• Link Forms
• Connected leaves
• Checklists
• Any graph, table or image embedded in the file.
• word art
• Most external data functions

Therefore, your document loses some of its usability, making applying client-side encryption to an existing document something you should only do if you’re happy with a static document.

Encrypted Google Drive files on Android and iOS devices

Unfortunately, Google Drive does not offer Android and iOS device users the ability to create, copy, or upload encrypted files client-side. But it’s not all bad news: you can still download and preview encrypted files on both types of devices.

However, even that feature is not perfect. Android and iOS users cannot access encrypted Google Docs, Slides, or Sheets files because they are not yet supported. You can only access file types that are supported by Google Drive but are not part of the Google Document creation toolset, such as Microsoft Word and PDF files.

Simplified encryption with Google Drive

There’s no need to use complicated third-party workarounds (although third-party encryption is possible) with Google Drives. The app automatically encrypts everything you create or upload to it with 256-bit AES encryption, plus you can enable client-side encryption for localized protection. By combining these two encryption formats, your documents are protected from malicious intruders.

Now we are ready to hear from you. Do you think the encryption tools provided by Google Drive are enough to protect your documents? Have you had any problems with people accessing Drive files without permission? Tell us in the comments p below.