Google Drive for Business: Permissions, Folders and Best Practices

Why Google Drive needs a business structure

Google Drive may begin as a simple folder and quickly become the document center of a business. Problems appear when every person creates files independently, shares links without clear criteria and organizes documents according to personal preferences.

A business structure should answer practical questions:

• Where should each type of document be stored?
• Who can view it?
• Who can edit it?
• What happens when someone leaves the company?
• How can public links be prevented from exposing information?
• Who is responsible for reviewing permissions?

The goal is not to create many folders. It is to help people find what they need and keep access understandable over time.

My Drive and shared drives

Files in My Drive normally belong to an individual. This may be suitable for drafts or personal working documents, but it creates risk when important information depends on one employee's account.

Shared drives are designed for teams. Files belong to the team and remain in the shared drive even when a person leaves it.

When a business uses Google Workspace and its edition includes shared drives, store organizational documents there.

Examples include:

• Active contracts.
• Internal procedures.
• Sales materials.
• Project documentation.
• Shared accounting files.
• Brand resources.
• Forms and templates.

Personal drafts or temporary documents may stay in My Drive until they are ready for team use.

How to design a folder structure

A useful structure should be simple, stable and easy to explain.

A small business may begin with folders such as:

• 01 Administration
• 02 Finance
• 03 Sales
• 04 Operations
• 05 Human resources
• 06 Marketing
• 07 Projects
• 08 Templates
• 09 Archive

Leading numbers help maintain a stable visual order. They are optional but prevent folders from constantly changing position.

Within each area, create subfolders by process or period. For example:

• 02 Finance / 2026 / Supplier invoices
• 02 Finance / 2026 / Customer invoices
• 07 Projects / Client / Project
• 05 Human resources / Policies
• 08 Templates / Estimates

Avoid structures with too many levels. If someone must open six folders to reach a document, the hierarchy is probably too deep.

Basic file permissions

When sharing a Google Drive file, you can let a person:

• View.
• Comment.
• Edit.

The permission should match the real task. Do not grant editing access merely for convenience when reading is sufficient.

A final contract, approved policy or official template may be view-only. A draft under review may allow comments. A working document may require editing.

This separation reduces accidental changes.

Folder permissions

Folder permissions commonly apply to their contents. When a folder is shared, files and subfolders receive the corresponding level of access.

Do not mix documents with different confidentiality levels in the same folder.

For example, a general Human resources folder should not keep these items together at the same level:

• Manuals for the entire team.
• Private evaluations.
• Salary information.
• Medical documents.

Create separate restricted folders for sensitive information.

When a subfolder needs tighter access, use limited access and verify how inherited permissions behave.

Roles in shared drives

Shared drives provide several access levels, including:

• Manager.
• Content manager.
• Contributor.
• Commenter.
• Viewer.

Managers can control members and content. Other roles have progressively fewer capabilities.

Not everyone needs to be a Manager. Most members should receive the minimum level required for their work.

Teams that use Drive for desktop and need to manage non-Google files may require Content manager rather than Contributor access.

Sharing with external people

Sharing with clients, suppliers or advisers may be necessary, but it should be controlled.

Before sharing externally:

• Confirm the email address.
• Select the minimum access level.
• Avoid sharing an entire drive when one folder is enough.
• Set a date to review or remove access.
• Do not use public links for confidential information.
• Confirm whether company policy permits external sharing.

When an external person only needs one file or folder, share that item instead of adding the person to the whole shared drive.

Restricted and broad links

Restricted access limits use to added people or groups.

Link-based access may reach a broader audience, depending on organization settings.

Use restricted access for internal documents, client information, estimates, contracts and personal data.

Broader links may be appropriate for public catalogs, general instructions or files intended for distribution.

Before copying a link, review the sharing panel. Do not assume that a link is private.

Sharing through groups

A Google Group can simplify administration when several people need the same access.

Instead of adding users individually, share with a group such as:

• administration@company.com
• sales@company.com
• project-a@company.com

When someone joins or leaves, update the group instead of every folder.

This reduces forgotten permissions and makes audits easier.

File naming conventions

Names should make sense without opening the file.

A simple convention may include:

• Date.
• Client or project.
• Document type.
• Status.
• Version.

Example:

2026-08-01_Client-Project_Estimate_Approved.pdf

Avoid names such as:

• final document final 2
• new copy
• updated file
• untitled

Google Drive keeps version history for many files, so multiple confusing copies are not always necessary.

Templates and official documents

Centralize templates in a folder that is view-only for most people.

Examples:

• Estimates.
• Sales proposals.
• Reports.
• Presentations.
• Meeting notes.
• Forms.
• Brand assets.

People should make a copy for their work and leave the master template unchanged.

Also record:

• Maintenance owner.
• Update date.
• Version.
• Approving department.

Periodic access reviews

Permissions should not be configured once and forgotten.

Review them regularly to identify:

• People no longer involved in a project.
• Old external accounts.
• Unnecessary public links.
• Folders without an owner.
• Excessive Managers.
• Important files in personal accounts.
• Duplicate documents.

A quarterly review may be enough for a small business. Teams with sensitive information may need more frequent controls.

What to do when someone leaves

Before suspending or deleting an account:

• Review files in My Drive.
• Transfer business documents.
• Remove unnecessary external access.
• Update groups.
• Change folder and process owners.
• Check automations and forms.
• Retain required information according to company policy.

Files stored correctly in a shared drive remain with the team, making this process easier.

Common mistakes

Sharing an entire folder when one file is enough

This exposes more information than necessary.

Giving everyone editing permission

This increases the risk of accidental changes and deletion.

Keeping critical files in personal accounts

The business may lose access when someone leaves.

Using public links as a quick solution

A link can be forwarded outside its intended context.

Creating a different structure for every project

Inconsistency makes search and training more difficult.

Ignoring inherited permissions

Permissions from a parent folder may affect files and subfolders.

Google Drive business checklist

Use this list to review your organization:

• Critical documents are in shared drives.
• Every folder has a clear purpose.
• Access levels match real tasks.
• Sensitive information is separated.
• Public links are exceptional.
• External access has an owner.
• Groups are used for stable teams.
• Official templates are protected.
• Files follow consistent names.
• Permissions are reviewed regularly.
• A user offboarding procedure exists.
• Manager access is limited.

Conclusion

Google Drive can be a simple file-sharing tool or an organized document platform. The difference lies in structure, permissions and administration.

For a small business, good practice means keeping a limited number of main folders, using shared drives for company documents, granting the minimum required access and regularly reviewing people, groups and links.

Read our Google Workspace for business guide to explore the rest of the environment and the criteria for choosing an edition.