How to Stop Employees Walking Out the Door with Your Business Data (google workspace)

The Default Setting You Didn’t Ask For

When you sign up for Google Workspace, Google sets it up under the assumption that individual users “own” their data. That sounds nice and trust-oriented in theory, but in the real world of running an Australian small business, your operational data is your hard-earned intellectual property.

By default, any staff member can use Google Takeout to package up every piece of company data they have access to into a neat, downloadable .zip file.

On top of that, Drive for Desktop lets employees quietly sync shared company drives directly to their personal laptops or home computers.

In this article, I’ll show you how to check if anyone has already downloaded your files and step you through locking both backdoors down for good – in under five minutes.

Step 1: Check If Anyone Has Already Exported Your Data

Audit Google Takeout Activity

1. Log into admin.google.com using your Super Admin account (the main account you used when setting up Workspace).
2. In the left-hand menu, navigate to Reporting → Audit and investigation → Takeout log events.
3. Remove the pre-set date filter in the search bar and click Search.

If anyone in your organisation has run a Takeout export in the last 6 months (the limit of this report), you’ll see their name, the exact timestamp, and which services (Gmail, Drive, Contacts, Calendar) were downloaded.

Audit Drive for Desktop Activity

1. From the left menu, head to Reporting → Audit and investigation → Drive log events.
2. Remove any default date filter.
3. Add a filter for App Name IS Google drive for desktop and click Search.

This reveals every user who has used Drive for Desktop to sync or download company files to a local device in the past 6 months (the limit of this report).

Now that you’ve audited past activity, let me show you how to close these holes across your organisation.

Step 2: Shut Down Google Takeout

Disable Main Services

1. Go to Data → Data import and export → Google Takeout.
2. Click on User access to Takeout for Google services.
3. Just above the main service list, look for the box labelled “Services without an individual admin control”
4. Click Edit on the right side.
5. Select “Don’t allow for everyone” and hit Save.

Disable Secondary Services

1. Click on Google Takeout on the left hand menu again.
2. Click on User access to Takeout for Google services.
3. At the top of the Services column, click the main checkbox to select everything, then click Don’t allow. (This takes about a minute to process).

Note for Business Owners: Turning off Takeout for employees does not impact your ability as the admin to back up or migrate company data. The Organisational Data Export tool (under the Data menu) remains completely active and untouched.

Step 3: Restrict Google Drive for Desktop

Syncing files to unmonitored personal hard drives is a massive security risk. Unless your business has explicitly decided to use offline syncing on managed devices, you should turn this off.

1. Navigate to Apps → Google Workspace → Drive and Docs → Drive for Desktop.
2. Click into the setting that currently says “Allow Google Drive for desktop in your organisation” and turn it off.
3. Click Save.

Step 4: Need Exceptions? Use a Google Group

What if your accountant, HR manager, or key partner genuinely needs to export data or sync files for legitimate business reasons? This is where Google Groups can be used.

1. Go to Directory → Groups in your Admin Console and create a group (e.g., Data Exporters).
2. Add only the trusted staff members who require export access to this group.
3. Return to your Takeout and Drive for Desktop settings.
4. Keep the “Off for everyone” rule applied at your root organisational level, but apply an exception rule allowing access only for your new Exception Group.

Now you’re ensuring you’re in control of who downloads your business data.

---