GOOGLE DRIVE SECURITY | Share Files Safely, Control Access, and Stop Unwanted Sharing

Google Drive makes it easy to send documents,

spreadsheets, photographs, contracts, and other files to colleagues, customers, clients, and friends.

But sharing a file is more than sending a link.

The moment you grant someone access, you are making a decision about what they can see, what they can change, and sometimes what they can share with other people. One incorrect permission can expose information that was never intended for that audience.

For a student, that might mean sharing a private document with a class group. For a freelancer, it could mean exposing client files. For a small business, it might mean giving a customer access to an entire folder of internal records instead of one deliverable.

Google Drive provides tools for managing these risks. This guide shows you how to share files with the right people, choose appropriate permissions, inspect existing access, and remove access when it is no longer needed.

1. Understand the three main sharing roles

Before sharing anything, understand the difference between the main access levels available for files in My Drive.

Viewer

A viewer can open and read the file but cannot edit its contents or add comments. Downloading may still be permitted, depending on the file's settings.

Use this role when someone only needs to read a report, view a document, or inspect a finished deliverable.

Commenter

A commenter can read the file and add comments or suggestions where supported, but cannot directly edit its content.

Use this role when you want feedback on a draft without giving someone full editing control.

Editor

An editor can modify the file. Depending on the file and sharing settings, editors may also be able to move or delete content and change sharing permissions.

Use this role only when the recipient genuinely needs to collaborate on the file.

The practical rule is simple: give each person the lowest level of access that allows them to complete their task.

If a client only needs to read a final report, Viewer is generally more appropriate than Editor. If a colleague must revise a shared spreadsheet, Editor may be necessary.

Google's official guide explains the available roles and sharing permissions.

2. Share a file with a specific person

Sharing directly with a named recipient is often a better starting point than making a file available to anyone with its link.

On an Android phone or tablet

1. Open the Google Drive app.
2. Find the file you want to share.
3. Tap the three-dot menu beside the file.
4. Tap Share.
5. Enter the recipient's email address.
6. Select the appropriate role: Viewer, Commenter, or Editor.
7. Review whether the recipient should receive an email notification.
8. Tap Send.

The exact interface may vary slightly with app updates and account type.

On a computer

1. Open Google Drive.
2. Select the file.
3. Click Share.
4. Enter the recipient's email address.
5. Choose the appropriate access role.
6. Review the notification option.
7. Click Send or the corresponding confirmation control.

Example: sending a proposal to a client

Suppose you have prepared a proposal for a prospective customer.

The client needs to read the proposal but should not change the original document.

A sensible workflow is to share the proposal directly with the client's verified email address and assign Viewer access.

If the client later needs to suggest changes, you can reconsider the role or use a commenting workflow.

This approach reduces unnecessary editing access while keeping collaboration possible.

Official instructions: Share files from Google Drive.

3. Understand the risks of sharing with a link

Google Drive offers a General access setting that controls whether a file is restricted or broadly accessible.

The options available depend on your account and its administrative settings.

Restricted

Only people who have been granted access can open the file.

This is generally the safer starting point for private documents, internal business records, drafts, contracts, and sensitive information.

Anyone with the link

People who have the link can access the file without necessarily signing in to a Google Account, subject to the role and other applicable restrictions.

This can be convenient for public resources, downloadable materials, and documents intended for a broad audience. It also means that the link may be forwarded to other people.

A link is not a reliable secret if you distribute it widely or publish it somewhere public.

How to check link access

On Android:

1. Open Google Drive.
2. Tap the three-dot menu beside the file.
3. Tap Manage access.
4. Find General access.
5. Review the current setting.

On a computer:

1. Select the file in Google Drive.
2. Click Share.
3. Find General access.
4. Review whether the file is restricted or available to anyone with the link.

If the document contains private information and broad access is unnecessary, change the setting to Restricted and confirm that the intended recipients still have access.

Do not assume that a link is private simply because you sent it to one person.

Official instructions: Share and manage access to files and folders.

4. Be especially careful when sharing folders

A common mistake is sharing a folder when the recipient only needs one file.

Suppose you have a folder containing:

• A proposal for a client.
• Internal pricing calculations.
• A spreadsheet of expenses.
• Copies of invoices.
• Draft documents.

If you share the entire folder with the client, the other files may become accessible under the folder's permissions.

Google Drive applies permissions from parent folders to their contents. You generally cannot give someone less access to a file than they inherit from its parent folder.

This means the decision to share a folder can have consequences beyond the one document you intended to deliver.

A safer workflow

1. Identify the exact file the recipient needs.
2. Share that file directly if it is appropriate.
3. If several files are required, consider creating a separate folder containing only those files.
4. Check the new folder's contents before sharing.
5. Assign the minimum necessary access.
6. Review the folder's General access setting.

For a customer delivery, you might create a folder called Client Deliverables containing only the approved documents.

Keep private working files in a separate location with different access permissions.

Remember that creating a separate folder does not automatically make it private. Review its permissions before sharing it.

Official guidance: How folder sharing and inherited permissions work.

5. Audit who already has access

You do not have to wait for a security problem before reviewing your sharing settings.

Files accumulate over time. You might share a document with a temporary collaborator, grant access to a contractor, or make a file available by link for a short project.

When the project ends, those permissions may remain.

Review access on Android

1. Open the Google Drive app.
2. Find the file or folder.
3. Tap its three-dot menu.
4. Tap Manage access.
5. Review the people listed and the General access setting.
6. Identify anyone who no longer needs access.

Review access on a computer

1. Open Google Drive.
2. Find and select the file or folder.
3. Open its Share settings.
4. Review the people and groups with access.
5. Check the General access setting.

If a file is stored in a shared folder, investigate the parent folder's permissions as well. A file-level review alone may not reveal the full source of someone's access.

What should you look for?

Check for:

• Former employees or contractors.
• People involved in completed projects.
• Recipients who were given Editor access unnecessarily.
• Old public or link-based sharing settings.
• Unfamiliar email addresses.
• Folders containing files intended for different audiences.

Do not remove access blindly. Some people may still need it for legitimate work. Confirm the purpose of the permission before changing it.

6. Remove access when it is no longer needed

When someone no longer needs a file, remove their access instead of relying on them to stop using the link.

On Android, the general workflow is:

1. Open the file's three-dot menu.
2. Select Manage access.
3. Find the person whose access you want to remove.
4. Open the permission control beside their name.
5. Select Remove access if the option is available.
6. Confirm or save the change if prompted.

On a computer, open the file's sharing settings, find the recipient, open the permission menu, and select the option to remove access.

The wording and placement can vary by interface.

After removing a recipient, check whether they can still access the file through a shared parent folder or another permission grant.

What if the file was shared with anyone who has the link?

Change General access from Anyone with the link to Restricted if broad access is no longer appropriate.

Then verify that the people who still need the file have been granted access individually or through an appropriate group.

Removing one person's direct permission will not necessarily prevent access if another applicable permission still grants it.

Official instructions: Stop, limit, or change sharing.

7. Know what happens when you share a shortcut

Google Drive shortcuts let you make a file or folder easier to find from another location without creating another independent copy.

For example, a team might keep an original project document in one folder and place a shortcut in a shared project folder.

This can make organisation easier, but it does not automatically grant everyone permission to open the original item.

A shortcut points to the original file. The original item's access permissions still matter.

Before sharing a shortcut:

1. Identify the original file or folder.
2. Confirm who can access the original.
3. Check the permissions on the destination folder.
4. Test whether the intended recipient can open the original item.
5. Grant the necessary access through the original item's sharing settings if required.

Do not assume that putting a shortcut in a shared folder makes the underlying document available to everyone.

Official guide: Find files and folders with Google Drive shortcuts.

8. Protect confidential files with a deliberate workflow

Consider a freelancer who prepares a report containing business information for a client.

The report may be appropriate for the client, but the working folder might also contain internal notes, draft calculations, and other clients' documents.

A safer process looks like this:

Step 1: Separate the deliverable.

Create or identify the final report without including unrelated working files.

Step 2: Check the contents.

Open the document and verify that it does not contain information intended for another audience.

Step 3: Review its access settings.

Use Restricted access unless broader sharing is genuinely required.

Step 4: Add the recipient.

Share with the client's verified email address and choose Viewer or another role appropriate to the task.

Step 5: Test the result.

Confirm that the intended recipient can open the document and that the access arrangement matches the purpose of the share.

Step 6: Review access later.

When access is no longer necessary, remove it or change the sharing arrangement.

This workflow is useful for freelancers, consultants, students, small businesses, community organisations, and anyone who handles documents for other people.

9. Understand the limits of sharing controls

Google Drive's permissions help control access, but they are not a guarantee that information cannot be copied or disclosed.

For example:

• A viewer may be able to download, print, or copy a file unless the relevant controls prevent those actions.
• Someone who already saw information may remember it or capture it outside Drive.
• A recipient may have access through another shared folder or group.
• Organisational administrators may impose additional restrictions or policies.
• Some controls differ between account types and file types.

Where available, file owners can use sharing settings to restrict certain downloading, printing, or copying actions for viewers and commenters. These controls do not eliminate every possible method of reproducing information.

For highly sensitive information, consider whether sharing the file is appropriate in the first place. You may need a more controlled system, formal access procedures, or advice specific to your organisation's requirements.

10. Build a monthly Google Drive access review

You can turn these practices into a simple maintenance routine.

Once a month, set aside time to review important files and folders.

Start with items such as:

• Client deliverables.
• Business contracts.
• Financial documents.
• Staff or volunteer records.
• Shared project folders.
• Publicly accessible resources.
• Files previously shared with temporary collaborators.

For each item, ask:

1. Who can currently access it?
2. Does each person still need access?
3. Is the assigned role appropriate?
4. Is General access more permissive than necessary?
5. Does a parent folder grant additional access?
6. Is the information still suitable for the people who can see it?

Prioritise files that contain confidential or business-critical information.

For a small business, this process can be included in a broader digital-security checklist. For an individual, it can be a useful way to prevent old sharing arrangements from being forgotten.

11. Practical exercise: secure one shared file

You can practise the workflow without changing every document in your Drive.

Choose a non-sensitive file that you own and can safely use for testing.

• [ ] Open its sharing settings.
• [ ] Identify the current people and groups with access.
• [ ] Check whether General access is Restricted or available to anyone with the link.
• [ ] Confirm whether the current roles are appropriate.
• [ ] If the file does not need broad access, restrict General access.
• [ ] Remove an unnecessary permission if you have identified one.
• [ ] Recheck the settings after making changes.
• [ ] Confirm that the intended recipient can still access the file.

Do not use a confidential business document as your first experiment. Start with a harmless file so you can learn how the controls work without risking important information.

Final thoughts

Google Drive is more than a place to store files. It is also a system for granting and managing access to information.

Good sharing practices begin before you send a link. Choose the right recipient, assign an appropriate role, understand the difference between file and folder permissions, and review access when circumstances change.

Most importantly, remember that easy sharing and safe sharing are not always the same thing.

A well-managed Drive makes information available to the people who need it without unnecessarily exposing everything around it.

Take a few minutes to review your important files today. The small habit of checking permissions can help protect your documents, your clients, your collaborators, and your business.

Official resources

• Share and manage access to files and folders
• Share files from Google Drive
• Stop, limit, or change sharing
• Find files and folders with shortcuts 

Image: Google Workspace