Supporting Data Governance and Compliance
Core concepts
Governance in Workspace centers on retention, eDiscovery, audit, and data regions. Vault provides retention rules (default and custom), holds, searches, and export for supported services. Retention can be based on time or on events, and holds preserve data even when users delete it. Audit logs (admin, login, Drive, and others) feed investigation and can be exported to BigQuery or a SIEM. Data regions let you store covered data in a chosen geography. Google Takeout supports export for users, and Drive DLP and trust rules govern content movement.
Traps
A frequent confusion is retention vs hold: a hold overrides deletion but does not by itself define how long data lives after the matter closes. Another is scope - Vault covers specific services, and not every Workspace service is covered. Audit log retention differs by log type and edition, and logs are not infinite. Data regions apply to covered data for eligible editions, not to every product. DLP rules can block or warn; a question may test which action fires first when multiple rules match. Legal hold does not prevent a user from being suspended, but deletion behavior depends on the hold.
Rule of thumb
Separate the question into three layers: what data exists (audit/export), how long it must live (retention), and what must be preserved for a matter (hold). For a worked example, to preserve a custodian's mail during litigation: place a Vault hold on the account, confirm the hold covers Gmail, and do not rely on a retention rule alone.
Worked check
Before closing an investigation, confirm the hold is removed only after retention obligations are satisfied.