When a project manager at a 15-person management consultancy handed in her notice, the partners realised the files for three active client engagements were stored in her personal Google Drive. Not in a shared space, not in a company folder. In her personal account. The files were technically still accessible because her account was live, but nobody else knew what anything was called or where it lived. The knowledge was hers, not the firm’s.
That situation is entirely avoidable. The fix is structural, and it takes less than an afternoon to set up correctly from the start.
What is a best-practice Google Drive structure?
A well-structured Google Drive uses Shared Drives organised by business function rather than document type, with a consistent set of five top-level drives, naming conventions applied to every file, and permissions granted at the drive or folder level. The defining characteristic is that files belong to the team, not to the person who created them, so access continues regardless of who is in the role.
Google’s own admin documentation makes the distinction explicit: in a Shared Drive, files belong to the team and persist even when the individual account holder leaves or their account closes. That single feature changes how a firm should think about where any piece of work lives.
The five-drive pattern used by Pipeline Digital (a UK Google Workspace implementer) and Cloud Computer Company organises work into five areas. Growth covers sales, marketing, and business development. Customer Delivery holds all client work, with one subfolder per client and project phases inside each. Operations stores HR, finance, IT, and internal procedures. Admin handles corporate housekeeping: Companies House filings, insurance, and firm-level contracts. Client holds master templates for proposals, reports, and onboarding documents, separate from live client folders.
Nesting should stay at two to three levels. Overdrive, a Drive consultancy, recommends adding subfolders only when a folder contains 20 or more files, which keeps the structure navigable without requiring a guide to use it. A short “Drive etiquette” note pinned to the top of each drive documents the naming convention: date-first format (YYYY-MM-DD_ClientName_DocumentType) makes files searchable and sortable without any additional tagging.
Why does it matter for your business?
File governance has direct compliance implications for owner-managed firms. Under UK GDPR, you must be able to locate, export, and delete client personal data on request. FCA-regulated businesses face additional record-keeping requirements. The NCSC’s small business cyber guidance treats access control as a baseline security measure. A well-structured Drive makes all three easier to satisfy and protects you when staff leave.
The ICO’s data security incident statistics show that misdirected emails and wrong-recipient sharing are consistently among the most frequently reported breach types under UK GDPR. The same failure can happen inside a poorly managed Google Drive: files shared publicly by accident, or a departing team member retaining access to sensitive client records long after leaving.
The NCSC’s Small Business Cyber Security guidance recommends access control based on business need, specifically least privilege, alongside regular removal of access that is no longer required. In Google Workspace, this maps directly to Shared Drive membership: add people by role, review membership quarterly, and remove leavers on their last day.
For FCA-regulated firms, whether a small IFA, a mortgage broker, or a payments business, the obligations go further. FCA guidance on cloud outsourcing (FG16/5) expects firms to understand exactly where data sits and to be able to produce records in a usable format. A structured drive with clearly labelled client and compliance folders makes that straightforward, rather than a manual audit exercise every time a regulator asks.
Where will you actually meet it?
Many owner-managed services firms hit the Google Drive problem in one of three moments: a staff departure that reveals how much lived in personal folders, a client requesting access to shared documents, or an audit that requires producing records quickly. These situations expose what was always true: without Shared Drives and clear naming, your file access depends on who is currently in the room.
The staff-departure moment is the most acute. When someone leaves and their client files are in a personal account, you face a race between exporting what you can access and losing what you did not know was there. Google’s documentation confirms that files in personal My Drive accounts are tied to the individual account holder.
The second common trigger is new-hire onboarding. When a new team member joins and cannot find anything, the firm discovers files spread across several locations, named inconsistently, with no shared logic. The time spent rebuilding a workable structure always exceeds what it would have taken to set it up correctly in the first place.
The third is a data subject access request under UK GDPR. When a former client asks you to confirm what personal data you hold about them, a disorganised Drive makes it genuinely difficult to answer with confidence. A structured folder per client with standard subfolders turns that exercise into a 20-minute check rather than a significant investigation.
When should you build it, and when can you leave it?
A five-drive structure is worth building as soon as you have more than three or four people and files that matter for compliance or client delivery. The case for waiting is weak: the later you leave it, the harder migration becomes. The only genuine reason to pause is if no one in the firm will consistently enforce the naming conventions once they are set.
If you handle very high volumes of media assets, such as a creative agency managing large image or video libraries, a Digital Asset Management system is likely a better fit than Google Drive alone. Drive is effective for documents and structured project files; it becomes unwieldy for asset management at scale.
Similarly, some regulated sectors need immutable audit trails or formal records management that a folder structure alone cannot satisfy. Legal firms with certain practice areas, or financial services businesses with specific compliance requirements, may need specialist document management software alongside Drive rather than relying on it as the only solution.
The most common reason a well-designed structure fails is not technical. Jungle Soul Collective, a service business that has documented its own Drive setup publicly, makes this point directly: systems that do not match how people mentally organise their work get abandoned. Leadership needs to model the convention, review it after the first month of use, and adjust where the structure does not fit how work actually moves through the firm.
What else sits alongside a good Drive structure?
A Google Drive structure handles the physical layer of file organisation. It sits underneath broader concepts that owner-managed firms often encounter together: data governance (what you keep and why), records retention (how long different file types stay on the system), access management (who can reach what), and cyber baseline controls. The NCSC’s Cyber Essentials framework includes cloud service configuration as a certifiable minimum standard.
Data governance is the policy layer: it defines rules for what gets stored, for how long, and who is responsible. A Drive folder structure enforces none of those rules automatically; it makes them easier to act on. The ICO’s accountability guidance expects UK organisations to have documented retention and deletion policies, not just the technical means to act on them.
Records retention is a related but distinct obligation. Under UK GDPR, personal data should be kept only as long as necessary. FCA-regulated firms have additional minimum retention periods that vary by product type and record category, often five years or more for certain financial advice records. A labelled, dated archive folder per client makes applying those schedules far more practical than searching scattered files.
If you are planning to use AI tools to search or retrieve from your knowledge base, a structured, consistently-named Drive is a prerequisite. AI retrieval works on what it can access and parse; a disorganised Drive with inconsistent naming returns results that reflect the chaos rather than the knowledge.
