Turn on two-step verification first (Settings → Security): every change to a protection asks for a code from your authenticator app.
Then choose Protect… in the menu of a folder or file:
- Ransomware protection keeps every version and every deleted file for the number of days you choose. Files can still be edited and deleted, but nothing can be deleted for good before the date.
- Write-once locks the files: they cannot be changed, renamed, moved or deleted until the date. New files can be added and are locked too.
A standard protection can be ended by its owner after a waiting period (you get an e-mail when that starts, and can cancel it). A compliance protection cannot be shortened or ended by anyone. The Protection page lists everything that is protected; extend a protection there at any time.