Workspace Admin · Domain 3 of 6

Workspace Admin Domain 3: Managing data governance and compliance

This section covers keeping Workspace data under control: Vault retention, holds and exports, data loss prevention rules, Drive trust rules, Takeout and Data Export, data regions, and classification labels for Drive and Gmail.

Exam weight
~15%
Official objectives
5
Estimated questions estimate
8
Suggested study time estimate
8–11 hrs

About 13 min read Reviewed October 2026

Overview

Section 3 accounts for about 15% of the exam and focuses on what happens to data after it is created. Google Vault handles retention, legal holds, search, export and audit for eDiscovery. Data loss prevention (DLP) rules inspect Gmail, Drive and Chat content and can warn, block or audit when sensitive information appears. Drive trust rules limit who can share with whom, both inside and outside the organisation.

The section also asks how an administrator stores and exports the environment's data, including user Takeout settings, the admin Data Export tool, data regions and regulatory settings. Finally, it covers classification labels, which tag Drive files and Gmail messages so that DLP and other policies can act on them. Questions often combine two of these tools in one scenario.

How it's tested

Section 3 scenarios usually come from legal, compliance or security teams. Someone needs data kept, found, exported, protected from sharing or stored in a particular region. Pay attention to whether the requirement is to preserve, delete, detect, restrict or export, because each maps to a different tool with different scope rules.

  • Preserve vs. purge

    A legal or policy requirement is described, and you decide between a Vault retention rule, a hold, or both, and their scope.

  • Detect sensitive content

    Confidential data must not leave the company, and you choose DLP detectors, the services covered and the rule action.

  • Who may share with whom

    Sharing between OUs, domains or visitors must be limited, and you choose the Drive trust rule that expresses it.

Reasoning it through

Legal places three executives under investigation and asks that none of their mail or Drive files be lost, even though the company has a 90-day retention rule for Gmail. A retention rule alone would still purge mail after 90 days. A hold in a Vault matter, scoped to those three accounts and to Gmail and Drive, preserves their data regardless of retention rules until the hold is removed. Holds take precedence over retention.

Objectives 5

Official objectives from the Google Cloud outline, in outline order.

3.1 Using Google Vault for eDiscovery and data retentionArchive licenses, retention rules, holds, search, export and audit reports.
What it means
This objective covers when to use Archived User licenses, setting retention policies, placing data holds, writing retention rules by date or content, searching and exporting data, configuring export location settings, and reviewing Vault audit reports.
What to understand
Retention rules decide how long data is kept and then purged; a default rule covers a whole service, while custom rules target OUs, dates or terms. Holds preserve data for specific users or OUs indefinitely and override retention. Searches and exports happen inside matters, which group the work for a case. Vault only covers data that still exists in an active or archived account, so deleting a user removes their data from Vault.
How it shows up
A legal or retention requirement is described, and you choose between a retention rule, a hold, a matter search or an export.
Common confusion
Believing a retention rule protects data from deletion forever; only a hold preserves data indefinitely.
3.2 Creating and managing data loss prevention (DLP) rulesServices covered, detectors, regex, actions, scope and notifications.
What it means
This objective covers the DLP capabilities available for Gmail, Chat and Drive, using predefined content detectors and custom regular expressions, choosing rule actions, applying rules to the right services and users, and writing custom notifications that explain the block to the user.
What to understand
A DLP rule has a scope (OUs or groups), triggers (such as a file being shared or a message being sent), conditions (detectors, word lists or regex with likelihood and minimum match counts) and actions (block, warn, or audit only). Running a rule in audit mode first shows how often it would fire. Custom messages tell users why sharing was stopped and what to do instead. DLP for Drive acts on external sharing, while Gmail and Chat rules act on messages.
How it shows up
A sensitive data type must not leave the organisation, and you build the detector, scope and action.
Common confusion
Using a Gmail content compliance rule when the requirement covers Drive and Chat too, which needs DLP.
3.3 Creating and managing Drive trust rulesLimiting or blocking sharing by OU, domain or user, and external access.
What it means
This objective covers creating Drive trust rules that limit or block sharing between OUs, groups, domains or users, and setting whether people outside the organisation, including visitors without Google accounts, can receive shared files.
What to understand
Trust rules describe sharing as a pair: who is sharing and who they may share with. Rules can allow, limit or block, so you can stop an internal research OU from sharing with sales, or allow contractors to share only with one partner domain. Visitor sharing lets non-Google users access files with a verification code, and admins can turn it off. Trust rules replace older OU-level external sharing settings once adopted.
How it shows up
Two groups or domains must not exchange files, and you choose the trust rule direction and action.
Common confusion
Using DLP when the restriction depends on who the recipient is rather than what the file contains.
3.4 Determining how to store and export your environment's dataTakeout, Data Export, data location and regulatory settings.
What it means
This objective covers configuring Google Takeout for users, using the Data Export tool to export the organisation's data, choosing data location settings, and setting legal and compliance options for regulations such as HIPAA or GDPR.
What to understand
Takeout lets users download their own data and can be turned off by OU or per service. The Data Export tool lets a super admin export the whole organisation's data, which suits migrations away from Workspace or a full archive. Data regions, available in supported editions, store covered data at rest in a chosen geography such as the US or Europe. The legal and compliance page records agreements such as the HIPAA business associate amendment and data processing contacts.
How it shows up
A residency, regulatory or bulk export need is described, and you choose Takeout, Data Export, data regions or a compliance setting.
Common confusion
Using Vault exports for a full tenant migration; Data Export is designed for whole-organisation export.
3.5 Classifying dataDrive and Gmail labels, default labels, DLP-applied and AI classification.
What it means
This objective covers the use cases for labels applied by users, by DLP rules, by default on new content, or by AI classification, and creating classification labels for Drive files and Gmail messages.
What to understand
Labels add metadata such as Confidential or Internal to content. Users can apply them manually, admins can set default labels so new files start classified, DLP rules can apply a label when they detect sensitive data, and AI classification can learn from labelled examples to label files at scale in supported editions. Once applied, labels can drive search, DLP conditions and user awareness through badges.
How it shows up
A classification requirement is described, and you choose manual, default, DLP-applied or AI-applied labels.
Common confusion
Treating a label as a sharing restriction by itself; it needs a DLP rule or another policy to enforce anything.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Vault matter

    A workspace for a legal case that holds searches, exports and holds.

    Remember
    Access to matters can be shared with collaborators.
    Tested as
    eDiscovery workflow questions.
    Trap
    Running searches without creating a matter.

  • Retention rule

    Keeps data for a set period and then purges it.

    Remember
    Default rules cover a service; custom rules target OUs, dates or terms.
    Tested as
    Policy questions.
    Trap
    Using it to preserve data for a lawsuit.

  • Hold

    Preserves data for specific accounts or OUs indefinitely.

    Remember
    Holds override retention rules.
    Tested as
    Litigation scenarios.
    Trap
    Forgetting that holds do not survive account deletion.

  • Archived User license

    Keeps a former user's data available to Vault.

    Remember
    Vault coverage continues while the account exists.
    Tested as
    Offboarding with retention.
    Trap
    Deleting the user and expecting Vault to still hold their mail.

  • DLP detectors

    Predefined patterns for data such as card numbers and national IDs.

    Remember
    Combine with likelihood and match counts to reduce noise.
    Tested as
    DLP design questions.
    Trap
    Writing a custom regex for a type that a detector already covers.

  • DLP actions

    Block, warn or audit when a rule matches.

    Remember
    Audit first to measure impact.
    Tested as
    Rollout questions.
    Trap
    Blocking immediately and disrupting legitimate work.

  • Drive trust rules

    Rules that allow, limit or block sharing between defined parties.

    Remember
    They are based on who shares with whom.
    Tested as
    Sharing restriction scenarios.
    Trap
    Confusing them with content-based DLP.

  • Visitor sharing

    Lets non-Google users open shared files with a PIN.

    Remember
    Can be disabled by admins.
    Tested as
    External access questions.
    Trap
    Assuming external access always needs a Google account.

  • Google Takeout

    User self-service download of their own data.

    Remember
    Can be turned off by OU and per service.
    Tested as
    Data leakage questions.
    Trap
    Leaving it on for departing staff in a regulated OU.

  • Data Export tool

    Super admin export of the entire organisation's data.

    Remember
    Meant for whole-tenant exports.
    Tested as
    Migration away and archive questions.
    Trap
    Using Vault to export every user.

  • Data regions

    Store covered data at rest in a chosen geography.

    Remember
    Edition-dependent and set by OU.
    Tested as
    Residency requirements.
    Trap
    Assuming it controls where data is processed for every service.

  • Classification labels

    Metadata tags applied to Drive files and Gmail messages.

    Remember
    Applied by users, defaults, DLP or AI classification.
    Tested as
    Classification questions.
    Trap
    Expecting a label alone to block sharing.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Retention rule vs. hold

ConceptMeaningKey differenceCommon trap
Retention rule Keeps data for a period, then deletes it Policy-driven, broad scope Relying on it for litigation
Hold Preserves data indefinitely for named accounts or OUs Overrides retention, case-specific Leaving holds in place after the case closes

DLP vs. Drive trust rules vs. content compliance

ConceptMeaningKey differenceCommon trap
DLP rule Inspects content in Drive, Gmail and Chat Acts on what the data contains Using it to restrict sharing by recipient only
Drive trust rule Controls who can share with whom in Drive Acts on sender and recipient Expecting it to detect sensitive content
Gmail content compliance Matches Gmail message content for routing actions Gmail only Expecting it to protect Drive files

Takeout vs. Data Export vs. Vault export

ConceptMeaningKey differenceCommon trap
Takeout User exports their own data Self-service, can be disabled Leaving it enabled for leavers
Data Export Super admin exports all organisational data Whole tenant Using it for a single-case search
Vault export Exports search results from a matter Case-specific, auditable Using it for a full migration

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Retention for litigation

    What candidates pick
    Create a long retention rule for the users under investigation.
    Why it looks right
    Long retention sounds like preservation.
    Why it's wrong
    Retention rules still purge at the end of the period and can be changed; a hold preserves data until it is released.

    Clue to watch for Legal names specific people and a case.

  2. Delete then search

    What candidates pick
    Delete a former employee's account and rely on Vault to keep the mail.
    Why it looks right
    Vault is thought of as an archive.
    Why it's wrong
    Vault only covers existing accounts; keep the account with an Archived User license.

    Clue to watch for The user has left but the data is still needed.

  3. Content compliance for Drive

    What candidates pick
    Write a Gmail content compliance rule to stop credit card numbers being shared.
    Why it looks right
    It already scans content.
    Why it's wrong
    Content compliance only covers Gmail; DLP covers Drive and Chat as well.

    Clue to watch for Sensitive data is shared through files.

  4. DLP for team isolation

    What candidates pick
    Build a DLP rule to stop the research OU sharing files with sales.
    Why it looks right
    DLP is the best-known data control.
    Why it's wrong
    The restriction depends on who shares with whom, which is a Drive trust rule.

    Clue to watch for No specific content type is mentioned.

  5. Vault for migration

    What candidates pick
    Export every mailbox and drive through Vault for a move to another platform.
    Why it looks right
    Vault exports data reliably.
    Why it's wrong
    Data Export is designed for whole-organisation export; Vault exports are for matters.

    Clue to watch for The whole tenant must be exported.

  6. Region equals compliance

    What candidates pick
    Turn on data regions to meet HIPAA.
    Why it looks right
    Regulation sounds like residency.
    Why it's wrong
    HIPAA is handled through the business associate amendment and appropriate settings; data regions address where data is stored.

    Clue to watch for The regulation named is about health data, not location.

Answer framework

Classify each Section 3 requirement by its verb before choosing a tool.

  1. Preserve for a case: create a Vault matter and place a hold on the named accounts or OUs, covering every service that is in scope.
  2. Keep for a period and then delete: write a default or custom Vault retention rule with the correct scope.
  3. Detect sensitive content: build a DLP rule with detectors, scope and an action, starting in audit mode.
  4. Restrict who can share with whom: create a Drive trust rule, and decide whether external users or visitors are allowed.
  5. Export, store or classify: pick Takeout, Data Export, data regions or classification labels according to whether the need is per user, whole tenant, geographic or metadata.

Practice question

A financial firm must stop employees from sharing Drive files containing customer account numbers with anyone outside the company, but internal sharing of those files must continue. The security team wants users told why sharing failed. What should the administrator configure?

Want more like this? The Workspace Admin practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Spend most of your time on Vault, because retention and holds are where the scenarios are most precise. Create a matter, place a hold on a test account, write a short Gmail retention rule, and confirm through the help center that the hold wins. Then delete a test user and note what happens to their Vault data. That one exercise answers several common questions.

Next, build two DLP rules in audit mode: one with a predefined detector such as credit card numbers and one with a custom regular expression. Review the audit log entries, then switch one to block with a custom message. Compare the result with a Drive trust rule that stops one OU sharing with another, and write down why each tool fits its scenario. Finish with Takeout, Data Export, data regions and classification labels, which are shorter topics but appear in questions that pair them with Vault or DLP.

FAQ

How much of the Workspace Admin exam is Section 3?

Managing data governance and compliance is about 15% of the exam, around 8 questions.

Does a Vault hold stop users from deleting mail?

Users can still delete messages from their view, but the held data is preserved and remains searchable in Vault until the hold is removed.

Which services does DLP cover?

The exam guide names Gmail, Chat and Drive. Each rule chooses the services and triggers it applies to.

What is the difference between Takeout and Data Export?

Takeout is self-service for a user's own data. Data Export is run by a super admin to export the whole organisation's data.

Do data regions satisfy every compliance requirement?

No. They control where covered data is stored at rest. Other requirements, such as a HIPAA business associate amendment, are handled through separate legal and compliance settings.

Can labels be applied automatically?

Yes. Admins can set default labels, DLP rules can apply labels when they detect sensitive content, and AI classification can label files in supported editions.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered Vault, DLP, Drive trust rules, data export options, data regions and classification labels. Test whether you can match each compliance request to the right tool.

Take the Workspace Admin practice test Check your Workspace Admin readiness

Keep going