Data Privacy and Security in Google Drive – What You Need to Know

Google Drive allows you to back up data such as photos and documents online. Storing files in the cloud serves as a backup, but it is also practical if you want to access your data from anywhere. But how secure is Google Drive? And does it measure up when it comes to data privacy? 

Google Drive: What is the platform all about?

Google Drive is the file hosting service provided by Google LLC. Depending on whether you have a personal or business account, you can store data (photos, videos, documents, etc.) in this cloud to back it up online. With a business account, multiple team members can work on documents stored in the Google Drive cloud simultaneously. Google Drive also offers services such as Google Docs, Google Sheets, Google Slides, and other tools.
Before you place unconditional trust in cloud storage, you should take a look at your provider's data security and privacy policies. For example, what happens if the cloud becomes inaccessible? This actually happened with Google Drive just under two years ago. What about data privacy on Google Drive? And are there comparable alternatives to Google Drive? We have compiled all the relevant information for you: 

How does Google Drive handle data privacy?

According to a Google white paper on its infrastructure, the servers used to store user data in the cloud, as well as the software itself, are developed by Google. This is intended to reduce hacker and phishing attacks. However, the exact locations of the Google Drive servers remain unknown. While this may reduce the risk of targeted attacks, it does not provide transparency regarding exactly where data is stored. Google merely assures users that data is kept in "secure data centers."
One plus point is that data is encrypted during the upload process to Google Drive (AES 256-bit). Furthermore, pages and uploads are secured with SSL encryption, which is now the industry standard, ensuring that data cannot be viewed by third parties. Google also uses Perfect Forward Secrecy (PFS). This means that generated SSL keys cannot be reused for a past session, making it impossible to retroactively decrypt data that has already been transmitted. However, you will still look in vain for end-to-end encryption on Google Drive.
Unfortunately, there are also downsides when it comes to Google Drive and data privacy: Google's products frequently find themselves in the crosshairs of German and European regulatory authorities. A look at the fine print (privacy policies and terms of service) of Google Drive suggests this is justified: Google reserves the right to scan uploaded content using automated systems and algorithms. This is ostensibly done to improve user experience (such as identifying related photos) or to detect spam or illegal content. In addition, analysis and crash reports are generated by default, along with personalized search results, which help Google build a fairly accurate profile of its users. 
Want to delete your data after all? When data is deleted from Google Drive, Google commits to removing it from its systems within 180 days. However, this cannot be independently verified. 
A current debate concerns the Google Analytics service. It has been declared unlawful in Austria and other European countries due to clear data protection concerns regarding potential access by US authorities. It can be assumed that this also applies to other Google services, such as Google Drive.

Can data security be guaranteed on Google Drive?

Google holds a number of certifications to ensure data security on Google Drive, among other things. The Google Cloud Platform is certified by/with:

• The American Institute of Certified Public Accountants (AICPA) and
• ISO 27001 (SOC1, SOC2, SOC3).

These certifications require regular audits by independent bodies. Furthermore, according to Google, only the minimum number of people necessary have access to the data, for example for maintenance purposes. This occurs only under a customer agreement or following authorization granted during technical support.
You can also increase data security yourself by using two-factor authentication. Although this should be the security standard, the feature is not yet used by all users. With two-factor authentication, you need an additional code to log in, which is sent to your smartphone via SMS or generated using a special app on your device.

Alternatives to Google Drive

Looking for an alternative to Google Drive? Before you make the switch, take a closer look at Boxcryptor. It allows you to encrypt your data on Google Drive using zero-knowledge, end-to-end encryption. This means that you, and only you, can access your data.
If you would prefer to move away from Google, there are, of course, alternative cloud solutions. Especially when using cloud services for business, it is essential that they meet certain standards for data security and privacy:

• Sync.com is a cloud storage service starting at around 5 euros per month that exclusively uses end-to-end encryption.
• pCloud offers client-side encryption and is available either as an affordable monthly subscription (starting at around 3 euros) or as a lifetime cloud storage plan for just under 180 euros.  

Are you unsure how to handle personal data in the cloud for your business? Or do you have questions about data protection standards for cloud providers in a professional setting? Contact us for a no-obligation consultation!