Google Forms is now equipped with additional data loss prevention features (Data Loss Prevention)

21/08/2024

Table of contents

What’s changing

Google continually invests in data protection for Google Forms. Google has enabled a data loss prevention policy (DLP) for Google Drive applies to files submitted in external Forms, including Forms from external organizations. To expand on this, Google today announced that the DLP policy for form content in Google Forms is now generally available.

With DLP, forms with sensitive content can be blocked from being viewed or responded to by outsiders. Based on admin-configured DLP rules, this feature checks form content including questions, form titles and descriptions, and response options provided in the form, and prevent sensitive content from being shared externally; This feature does not check end-user-supplied form responses sent to external forms.

This screenshot of a Google Form includes mentions of “Project X.” DLP rules are configured to detect and prevent sharing of Forms with respondents outside the organization that contain any mention of “Project X”, sensitive content in this form.

Additional details

If you don't want DLP rules to apply to users in your domain, you can exclude certain groups or organizational units from DLP checks. You can also exclude DLP rules for forms by using nested conditional operators in DLP rules for Drive. To do this, add the ‘AND NOT’ conditional operator with a custom detector for “vnd\.google\-apps\.form” as a regex. In cases where you only want to apply DLP to a form, add a custom detector for “vnd\.google\-apps\.form” as a regex. Visit this Help Center to learn more about using Workspace DLP to prevent data loss.

Getting started

Admins
- Data loss prevention rules that apply to Drive files defined for your domain are automatically applied to Forms.
- Visit the Help Center to learn more about this feature.
End users: End users can respond to forms as normal for forms that do not violate DLP rules, but if the form violates Drive's DLP rules for their domain, the form editor can You may see a warning, and form respondents outside your domain may be blocked from viewing or responding to the form.

Rollout pace

Rapid Release domains: Gradual rollout (up to 15 days for feature visibility) starting on January 30, 2024
Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting on June 4, 2024