Everything your organisation produces, from contracts, minutes, presentations, budgets, to campaign material belongs in a Shared Drive owned by the organisation. Not in the My Drive of an individual account, and least of all in someone's private Gmail account. This is cheap to get right at the start and painful to repair later.
Why private accounts are a problem
Ownership. Files in a personal My Drive belong to that person, not to the organisation. Your admin cannot see them, back them up, or hand them to a successor.
Departures. When someone leaves, stops replying, or dies, their files go with them. You cannot suspend a private account or transfer ownership out of it.
No admin control. You cannot enforce 2-step verification, block risky third-party apps, or check who has access. A private account is often shared with family and mixed with personal data.
Data protection. Your organisation is responsible for the personal data in those files (members, donors, staff). In a private account you cannot demonstrate control, limit access, or handle a data request or a breach properly.
Everyday friction. Links break, access is requested one file at a time, and nobody is sure which copy is current.
None of this is about trusting the person. It is that the organisation has no handle on its own information.
What to do instead
One Shared Drive per organisation , split into more only when a team really needs its own. Shared Drives are owned by the organisation: members come and go, the files stay.
Use My Drive for personal drafts only. The moment a colleague needs it, it moves to the Shared Drive.
Keep at least two super admins and turn on 2-step verification — see Securing your accounts .
"I don't want a second mailbox"
The most common objection, and a fair one: nobody wants to check two inboxes. Two ways around it:
Forward and send-as. Create the org address, forward it to the inbox the person already uses, and add it in Gmail as a "send mail as" address. They keep one inbox, and still have a real org account for Drive, Calendar, and logging in.
Interim step. A private Gmail account can be added as a member of a Shared Drive. Access is then managed by the organisation and the files are owned by the organisation, which is a real improvement. Treat it as temporary: you still cannot enforce anything on that account.
Moving what is already there
Create the Shared Drive and add the people who need it.
Agree a small top-level folder structure first: five or six folders is plenty (for example Governance, Finance, People, Programmes, Communication).
Have each person move their organisation files in. From a Workspace account you can drag folders straight in and ownership transfers automatically. From a private account ownership cannot be transferred: copy the files into the Shared Drive (copies lose version history and comments), then delete the originals once everyone has confirmed the new location.
Re-share any links you sent out earlier, and check nothing important is still only in a My Drive.