Data loss prevention (DLP): finding, watching and protecting sensitive data
In short: Data loss prevention finds sensitive information and stops it leaving by mistake or on purpose. DLP tools recognise data by patterns, fingerprints or labels, watch email, web, endpoints and cloud apps, and can warn, block or encrypt. Start in monitor mode and tune before enforcing.
What DLP is for
Many breaches are not dramatic hacks. Someone emails a spreadsheet of customer details to the wrong person, uploads a contract to a personal cloud drive or copies files to a USB stick before leaving the company. Data loss prevention (DLP) is the set of tools and policies that recognise sensitive data and control where it can go.
DLP supports legal duties too. Under the UK GDPR, organisations must protect personal data with appropriate technical measures, and DLP is one of them.
Data states and where DLP looks
- Data in motion: crossing the network, for example in email or a web upload. Checked by email gateways, web gateways and network DLP.
- Data at rest: stored on file servers, databases or cloud storage. Discovery scans find where sensitive files actually live.
- Data in use: being opened, copied, printed or moved on a laptop. Checked by an endpoint DLP agent.
How DLP recognises sensitive data
| Method | How it works | Good for |
|---|---|---|
| Patterns | Regular expressions and checksums | Card numbers, National Insurance numbers |
| Keywords and dictionaries | Lists of words with scores | Medical terms, project code names |
| Exact data match | Compares against hashed values from a real database | Your own customer records, with few false alarms |
| Document fingerprinting | Recognises forms and templates | Contracts, patient forms |
| Labels | Reads sensitivity labels applied by users or rules | "Confidential" or "Internal only" documents |
| Machine learning classifiers | Trained models spot document types | CVs, source code, financial statements |
Policy actions
When a rule matches, the policy decides what happens. Options range from gentle to strict: log only, warn the user and let them justify the action, require encryption, quarantine the message for review, or block. Warnings work well for honest mistakes, because they teach at the moment it matters. Blocking suits clear cases such as bulk card numbers going to a personal address.
Rolling DLP out well
- Classify your data first: decide what counts as confidential and who owns it.
- Run discovery to find where sensitive data is stored.
- Start policies in monitor mode for a few weeks and review the matches.
- Tune rules to remove false positives, then switch on warnings, then blocking.
- Tell staff what is monitored and why. Monitoring must be proportionate and transparent.
- Route alerts to a team who can act, and review policies when the business changes.
Real-world example: a recruitment agency in Leeds turns on DLP in monitor mode. In the first fortnight it sees dozens of CVs being sent to personal webmail, mostly by consultants who wanted to work from home on their own laptops. Instead of blocking straight away, the agency gives staff secure remote access to the shared drive, then switches the rule to warn and finally to block for messages with more than five CVs. Complaints stay low because people have a safe alternative.
DLP is one layer among many. It works best alongside access control, encryption and good offboarding; see Types of security control.
Practice
Name the three states of data that DLP protects.
Why is exact data match more accurate than a simple pattern?
Why start DLP in monitor mode?
Key takeaways
- DLP finds sensitive data and controls where it can go.
- It covers data in motion, at rest and in use, through email, web, endpoint and cloud controls.
- Detection uses patterns, exact data match, fingerprints, labels and classifiers.
- Actions range from logging and warning to encrypting and blocking.
- Classify first, monitor and tune, then enforce, and be open with staff.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.