How to Stop Sending Sensitive Data in Gmail: DLP, Content Rules and Checks at Send

What we mean by sensitive data

The usual suspects:

• card numbers and bank details
• social security and other ID numbers
• passwords, API keys and access tokens
• client names, project code names, deal terms
• health or HR information

Outlook shops often catch these with an add-in like VIPRE SafeSend, which scans the email for keywords and patterns IT has listed and flags them at Send. In Gmail there are three ways to do something similar. They differ in one important way: when the check happens.

Option 1: Gmail content compliance rules (Workspace admins)

Google Workspace admins can set rules on outgoing mail in the Admin console, under Apps, then Google Workspace, then Gmail, then Compliance. A content compliance rule matches words, phrases or regular expressions in a message, and then does something with it: reject it, send it to a quarantine for an admin to review, or change where it goes.

Good for: a hard company-wide rule, such as "nothing with this project code name leaves the domain".

Where it falls short:

• It runs after you click Send. The sender finds out from a bounce, or not at all if the email is quarantined.
• Someone has to write and maintain the patterns. Regular expressions for card numbers that do not also catch order numbers take care.
• The person writing the email gets no chance to fix it. They wanted to send something. Now it is stuck and they do not know why.

Option 2: Google Workspace DLP for Gmail

DLP (data loss prevention) is the more advanced version. It comes with built-in detectors for things like credit card numbers and ID numbers from many countries, so you do not write the patterns yourself. Rules are set in the Admin console under Security, then Access and data control, then Data protection.

A DLP rule can block the message, quarantine it, or warn the user. The warning is the closest thing Google has to SafeSend's DLP scan: in Gmail on the web and in the Gmail app, the sender sees an alert that the email may contain sensitive content, with Back to editing or Send anyway.

Which plans have it: Enterprise Standard and Plus, Frontline Standard and Plus, and the Education editions. Business Starter, Business Standard and Business Plus do not include it, and personal Gmail has nothing like it.

Where it falls short:

• Only an admin can set it up, and only on those plans. Most small companies are on a Business plan.
• It is built for the security team's list, not your own mistakes. Nobody writes a DLP rule for "I keep sending the draft price list to the wrong client".
• It does not look at who the email goes to in the same way SafeSend does. It scans content. A clean email to the wrong person goes straight through.

Option 3: A check in the compose window

The third option checks the email in Gmail itself, at the moment you click Send, and shows you what it found. You remove the card number, swap the password for a secure link, and send. Nothing bounces, and nobody in IT has to review a quarantine.

Presend is a Chrome extension that does this. Its built-in checks include:

• Leaked API key / token. Known key formats, and anything the sentence calls a password or key, such as "the password is", even when the value has no known format. Set to Block by default.
• Sensitive number (SSN / card). Numbers shaped like card numbers or social security numbers. Also Block by default.
• Banned phrases. A list you set, such as a project code name or "do not forward".
• Your own rules. Written in plain English ("Block any email to an outside address that mentions salary") or as a pattern, with Block, Warn or Note.

When a check blocks, Send stops with "Hold on" and the reason, and you choose Review message or Send anyway. The same checks run in Outlook on the web and in other places you type, like Slack.

Which one to use

These are not either-or. A careful setup uses both ends:

• Content compliance and DLP (Options 1 and 2) are the company-wide net. If you are on a plan with DLP, turn on the built-in card and ID detectors with Warn users. They also give the security team a record.
• A check at Send (Option 3) is where most mistakes actually get fixed, because the person who made them sees them while they can still change the email.

If you are on a Business plan, or a small team without a Workspace admin, Option 3 is the one you can set up today. For the related problem of sending to the wrong person, see our Gmail external recipient warning guide. And for why API keys end up in email in the first place, see pre-send checks for attachments, recipients and leaks.