Data Detection Response
Data Detection and Response (DDR) is an approach that monitors sensitive data itself — where it lives, who touches it and how it moves — in order to detect misuse and exfiltration as they happen.
What is Data Detection Response?
Definition
Data Detection and Response (DDR) monitors sensitive data itself — where it sits, who touches it and how it moves — rather than watching only the endpoints and networks around it. That inversion is the point: classic controls ask whether an action was permitted at the boundary, while DDR asks whether this particular data behaving this way makes any sense, which is what catches slow exfiltration by an account that is entirely legitimate. It overlaps with DLP but is broader in intent, because it is built around responding to an event in progress rather than around blocking a rule violation.
Role in cybersecurity
Data Detection Response plays an important role in building organizational resilience against cyber threats. Implementing appropriate mechanisms in this area is required by regulations such as NIS2, DORA and ISO 27001.