* Access Admin Console: Log in to the Google Admin console using your administrator account.
* Navigate to DLP Rules: Go to Apps > Google Workspace > Drive and Docs > Data loss prevention.
* Create a New Rule: Click on Create a rule and choose to start with a template or create a custom rule.
* Set Content Detector Conditions: Use the existing content detector conditions that identify sensitive files.
* Configure Actions: Set the action to Disable download, print, and copy for commenters and viewers.
This ensures that external users with viewer permissions cannot download the files.
* Apply Rule to Relevant OUs/Groups: Set the scope of the rule to the specific organizational units or groups where you want this restriction to apply.
* Save and Implement: Save the rule and ensure it is activated. This will enforce the new restrictions for sensitive files shared externally.
References:
* Google Workspace Admin Help: Data loss prevention for Drive
* Google Workspace DLP Best Practices