Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard and Education Plus. Compare your edition
DLP for Gmail is also available to Cloud Identity Premium users who are also licensed for Google Workspace editions that include Gmail.
Google Workspace admins can create Data Loss Protection (DLP) rules that automatically add classification footers to outgoing Gmail messages sent to external recipients or to recipients with non-Gmail email apps.
Classification footers are displayed beneath the message body and the Gmail signature. They have information about sensitive message content and guidance on how the recipient should handle the message based on your organization’s data sharing and privacy policies. As an admin, you customize the text that appears in the footer when you create the DLP rule.
For DLP security for internal Gmail users, we recommend using DLP rules with Gmail classification labels to help Prevent data leaks in email & attachments.
How classification footers are added to messages
DLP rules scan outgoing messages when they’re sent. When message content activates a DLP rule with a classification footer action, the footer is added to the message when it’s sent.
You can create multiple DLP rules that add different footers to outgoing messages based on message content or other message attributes, for example the message subject or headers. If an email message activates more than one DLP footer rule, footers for all activated DLP rules are added to the message. For best performance, we recommend you follow DLP content and rule size limits.
Gmail DLP and content compliance footers
When a message activates both a DLP rule with an Add footer action and an append footer content compliance setting, the DLP rule takes precedence and the DLP footer is added first. Then the content compliance rule footer is added. Recipients see all footers in the message. Learn more about the Append footer setting
Known limitations
Classification footers are added asynchronously, and the sender doesn’t get a notification when a footer is added. Synchronous application of footers isn’t supported. Learn more about synchronous and asynchronous scanning
Add classification footers with a DLP rule
Take these steps to create a DLP rule that adds classification footers to messages that meet the rule conditions.
-
Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
-
Go to Menu
Rules > Create rule > Data protection.
Requires having the View and Manage DLP rule privileges.
-
Enter a name for the rule and, optionally, a description.
- For Scope, choose an option:
- To apply the rule to your whole organization, select All in domain.name.
- To apply the rule to specific organizational units or groups, select Organizational units and/or groups and include or exclude organizational units and groups.
- Click Continue.
- Under Gmail, check the Message sent box.
- Click Continue.
- To add a condition, click Add Condition and select the part of the message that is scanned:
Important: If you create a DLP rule with no condition, the rule scans all parts of the message and applies the specified action to every Gmail message.
- All content—Scans message header, subject, body, and attachments.
- Body—Scans message body and attachments.
- Email headers—Scans message header and subject. If the message is sent with Google Workspace Client-side encryption (CSE), only the content of the email headers (including subject) can be scanned.
- Subject—Scans message subject only.
- Classification labels—Scans classification labels applied to messages.
- Confidential mode status—Scans whether confidential mode is turned on for messages.
- Choose What to scan for and select the options and attributes for your scan. For details about this field, visit About What to scan for options & attributes on the Prevent data leaks in email & attachments page.
- Click Continue.
- Click Action and select Add footer to message, then enter custom text for the footer:
- Title—Optional. Header text for the footer that appears in bold above the main footer content. Can have up to 50 characters.
- Footer content—Text for the main footer content. Can have up to 300 characters, including any URL you add with Insert link.
- Insert link—Optional. The link text as you want it to appear in the footer and the destination URL for the link.
- Display as banner—Optional. Select this to add a color background to the footer.
- (Optional) In the Alerting menu, choose a severity level for reported message events: Low, Medium, or High. The severity level is logged in the Rule log events and can be used to investigate incidents.
- (Optional) To send an alert about message events (a message activated by this rule), check the Send to alert center box. You also send an alert notification to super admins with the All super administrators option. Enter other alert notifications for other recipients.
- Click Continue and review the rule details.
- Choose a status for the rule:
- Active—The rule runs immediately.
- Inactive—The rule is added but doesn't run immediately. This gives you time to review the rule and share it with others before implementing. To activate the rule later, in the Admin console, go to Security
Access and data control
- Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more
View classification footer log events
Use the security investigation tool to view log events for auto-applied classification footers. Use Rule log events as the data source. For detailed steps, visit the Investigate DLP rule events using the security investigation tool section on the Prevent data leaks in email & attachments page.Share your feedback
In the Admin console on any data protection pages, click Send Feedback.