Google enables client-side encryption for Drive, Docs, Sheets and Slides

Google has enabled Client-side encryption (CSE) across several Workspace services - Google Drive, Docs, Sheets and Slides - with support for multiple file types including Office files, PDFs, and more. The feature will also be enabled across other Google services including Gmail, Meet (currently in beta), and Calendar.

CSE gives you authoritative control and privacy as the sole owner of private encryption keys and the identity provider used to access those keys. It helps you strengthen the confidentiality of your sensitive or regulated data while addressing a broad range of data sovereignty and compliance needs, Google says.

To enable client-side encryption, you will set up an encryption key service through one of Google's partner services - Flowcrypt, Fortanix, Futurex, Thales, or Virtru. Your partner of choice either holds the key to decode encrypted Google Workspace files or simply provides you with software that allows you to hold the keys on-premise. It is worth mentioning that Google cannot access or decipher these files without this key.

You can also build your own service using the Google CSE API.

Google Workspace Client-side encryption is available to Enterprise Plus and Education Plus customers and will not be available to Workspace Essentials, Business Starter, Business Standard, Business Plus, Enterprise Essentials, Enterprise Standard, Education Fundamentals, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers. It may take up to 15 days before you see the feature.

Admins can enable the feature at the domain, OU, and Group levels. Go to Admin console > Security > Access and data control > Client-side encryption.

More details can be found here.