Data Loss Prevention (DLP)

DLP (Data Loss Prevention) is a category of security technology that prevents sensitive data — personal data, financial records, intellectual property, source code, customer data — from leaving the organisation through unauthorised channels. DLP solutions monitor data in three states: at rest (storage), in transit (network), in use (endpoints). When sensitive data is detected being copied, emailed, uploaded or printed in violation of policy, DLP can block, alert, or quarantine the action. DLP is mandated or strongly recommended by GDPR (Article 32), HIPAA, PCI-DSS, ISO 27001, NIS2 and DORA — and is one of the few controls that directly demonstrates 'appropriate technical measures' to regulators after a breach.

Three traditional categories plus a modern fourth: (1) **Network DLP** — monitors and blocks data leaving via email, web, IM at the network egress; deployed inline (Forcepoint, Symantec, Proofpoint), (2) **Endpoint DLP** — agent on each device monitors copy/paste, USB, printing, screen capture, file uploads (Microsoft Purview, Trellix, CrowdStrike Falcon Data Protection), (3) **Cloud DLP** — protects data in SaaS apps (M365, Salesforce, Google Workspace) via API integration; often part of CASB platforms, (4) **Modern integrated DLP** — Microsoft Purview (covers M365, endpoints, cloud, on-prem in one platform), Google Cloud DLP API, Cisco Cloudlock. Modern enterprises deploy all three layers simultaneously; legacy network-only DLP is insufficient for cloud-first workforces.

Five market leaders: (1) **Microsoft Purview Data Loss Prevention** — built into M365 E5/G5, covers email, Teams, SharePoint, OneDrive, endpoints; rapidly closing gap with specialists, (2) **Forcepoint DLP** — long-standing enterprise leader, comprehensive policy engine, strong in regulated sectors, (3) **Symantec DLP (Broadcom)** — broad deployment in Fortune 500, extensive content recognition, (4) **Proofpoint Information Protection** — strong email DLP, integrated with email security platform, (5) **Trellix DLP** (formerly McAfee) — endpoint and network coverage. Modern players: Nightfall AI, Polymer, Cyberhaven (data lineage), Code42 Incydr (insider threat focus). Cloud-native: Google Cloud DLP API, Microsoft Purview, Cisco Cloudlock.

DLP directly supports GDPR Article 32 ('appropriate technical and organisational measures') in several ways: (1) **Data discovery and classification** — DLP discovers personal data across the organisation (often surprising what data exists where), (2) **Access controls** — alerts or blocks unauthorised access to sensitive data, (3) **Outbound monitoring** — prevents personal data from being emailed, uploaded or copied to unauthorised destinations, (4) **Encryption enforcement** — automatically encrypts emails containing sensitive data, (5) **Audit trail** — comprehensive logging supports incident reporting and demonstrates accountability, (6) **Breach reduction** — detected exfiltration attempts often avoid Article 33/34 notification (and associated reputation damage). GDPR fines for inadequate protection of personal data reach €20M / 4% turnover; DLP investment is typically a fraction of single-incident exposure.

Pricing varies widely by deployment model: (1) **Microsoft Purview DLP** — included with M365 E5/G5 for organisations on M365, (2) **Forcepoint DLP** — per-user annual licence depending on modules, (3) **Symantec DLP** — per-user annual licence, highest for the full suite, (4) **Proofpoint Information Protection** — per-user annual licence, (5) **Standalone SaaS-focused** (Nightfall, Polymer) — per-user monthly subscription per integration. Implementation costs often exceed first-year licensing — DLP requires significant tuning to balance security with productivity (false positives are the #1 reason DLP projects fail). An enterprise rollout is a substantial project budget, driven mostly by tuning effort. Microsoft Purview has the lowest TCO for organisations already on M365 E5.

Six high-value use cases: (1) **GDPR/HIPAA/PCI compliance** — block unencrypted emails containing personal/health/payment data, (2) **Source code protection** — alert when developers copy proprietary code to personal email or cloud storage, (3) **M&A confidentiality** — protect deal-related documents during sensitive periods, (4) **Insider risk** — detect employees on the way out exfiltrating customer lists or IP, (5) **Cloud sprawl control** — monitor unsanctioned SaaS uploads (Shadow IT), (6) **Customer data export limits** — prevent bulk export of customer records by individual employees. Modern DLP integrates with insider risk platforms (Code42, DTEX, Microsoft Insider Risk Management) for behaviour-based detection.

Five common failure modes: (1) **Excessive false positives** — overzealous policies block legitimate work, users find workarounds, (2) **Incomplete data classification** — without knowing what's sensitive, DLP can't act effectively, (3) **Lack of business buy-in** — DLP perceived as IT control, business owners don't review or refine policies, (4) **Tool sprawl** — multiple DLP products without orchestration, (5) **Insufficient response capability** — alerts fire but no one investigates or remediates. Successful programmes: (1) start with 'monitor only' mode for 60-90 days to learn data flows, (2) prioritise top 3-5 data categories first (PII, payment, IP), (3) tune iteratively based on alert review, (4) involve compliance and legal teams in policy design, (5) integrate with SOC for response.

With deciding which categories of sensitive data the company needs to protect and where that data is processed — policies are built on that basis. Each new policy is best run first in simulation mode, where the rule does not enforce its actions, and tuned based on the results. Preparing users matters as much as well-set rules, because the policy evaluates their everyday actions.

Most often through sensitive information types — pattern-based classifiers (a regular expression, sometimes with checksum validation, and keyword lists) that detect, for example, credit card or bank account numbers. A policy can also use sensitivity labels applied to documents and predefined templates for financial, medical or privacy data.