Apply Default classification labels to new files automatically

Before you can apply Drive labels with Default classification, take the following steps:

• Learn how Drive labels work and best practices for using them. For details, go to Get started as a Drive labels admin.
• Create a label with a field that takes an options list value, or know of existing labels you want to use.

Default classification lets you apply default classification labels to new Drive files, based on the file ownership (either of an individual or a shared drive) within an organizational unit or group. Users and shared drives can belong to different organizational units, so they can have different default classification policies.

When a file’s ownership changes, Default classification labels are applied based on the new owner, but any existing labels aren't changed. For example, if a user moves a file from My Drive to a shared drive, the shared drive's labels are applied. Conversely, if a user moves a file from a shared drive to My Drive, the user's organizational unit or group labels are applied.

You might want to use default classification for general, low-risk labels, such as which department created the file, and DLP rules to apply labels used for data protection and retention.

While Default classification (described in this article) applies labels based on the user's organizational unit or group, AI classification requires you to train a model to recognize sensitive content in your organization. Once the model is trained, AI classification automatically analyzes new and existing files and applies labels according to file content. Learn more about AI classification.

You might want users to always fill out the value of a certain label field. For example, to assign a File Sensitivity level to all files, such as Top Secret, Internal, Public, or Personal.

You can accomplish this by creating a File Sensitivity label with a required field called Classification that has the four options. The automated classification policy applies the File Sensitivity label to new files, and highlights the required field to remind users to provide the label value.

If needed, you can set a default value for a selection field and then users can change the value if the default isn't correct.

If you want users to be able to edit field values for or remove the labels applied through a data classification policy, you must grant them permission from the label manager. For details, see Set who can view or use a label.

In some cases, you might want to apply labels that users can’t view or edit. Data classification labels are applied to new files whatever the user's permissions on a label are.

Default classification settings and DLP rules

Labels can be applied to a file by both default classification and DLP rules. Labels applied with DLP rules always take priority over labels applied with default classification.

Default classification settings and users

Labels are applied automatically when a user creates a file, transfers ownership to another user, or moves a file into a shared drive. The Data classification policy applies a label and can apply default values for selection fields. We recommend that you use the required field setting in the label manager to encourage users to apply fields. User permissions on the label don't impact the ability to apply a label through data classification. Data classification can be used to apply labels that users cannot modify or remove (or even see).

When you use labels for default classification, those labels are locked in the label manager. No one can edit, disable, or delete those labels. This prevents changes that could break business policies. To unlock a label, remove it from all default classification policies.