Data loss prevention (DLP)
Also known as: DLP, data leak prevention, data loss protection, information loss prevention
Data loss prevention (DLP) is a set of tools and policies that identify sensitive information, such as credit card numbers, health records, or confidential documents, and stop it from leaving an organization in unauthorized ways, such as through email, cloud uploads, USB drives, or AI chatbots.
DLP can warn users, block actions, or log them for review. While DLP helps prevent costly leaks, poorly tuned rules can frustrate staff with constant false alarms.
Data loss prevention (DLP), explained at three levels
At home
DLP is like a security checkpoint for information. If someone tries to email out a file full of credit card numbers, the system notices and stops it.
At work
DLP reduces the risk of accidental or deliberate leaks of customer, financial, and confidential information.
At home
At work, you might see a pop-up warning that an email contains sensitive information and asking whether you really want to send it. That's DLP helping prevent mistakes.
At work
DLP uses pattern matching (such as social insurance numbers), document fingerprinting, sensitivity labels, and machine learning classifiers. Policies apply across email, endpoints, cloud storage, browsers, and, increasingly, AI apps.
At home
DLP tools can see a lot of what you do on work devices. In my opinion, employees deserve clear information about what's monitored and why.
At work
Start with data classification and a few high-value policies in 'monitor' mode, then tune before blocking. Coordinate with privacy and HR teams, document monitoring under privacy law and workplace policies, and measure outcomes such as prevented incidents rather than alert counts.
Real-world examples
At home
Sophie tried to email a spreadsheet of client details to her personal account to work from home. A DLP warning appeared, and she used the company's secure file share instead.
At work
Carlos is privacy officer at an Ontario clinic network. He set up DLP rules that block health card numbers from being pasted into public AI chatbots, while allowing an approved internal AI tool.
How it compares
| feature | Data loss prevention (DLP) | Encryption (beginner version) |
|---|---|---|
| Protects against | Data leaving the organization | Data being read if stolen |
| Acts on | Sending, uploading, copying | Stored and transmitted data |
| User impact | Warnings and blocks | Usually invisible |
| Works best with | Data classification | Key management |
DLP stops data from leaving. Encryption makes leaked data unreadable.
For analysts
I'd begin DLP with a handful of rules for your most sensitive data and run them in monitor mode first. Tuning before blocking keeps staff on side.
History & origin
Early DLP products appeared in the mid-2000s from startups such as Vontu, which Symantec acquired in 2007, as regulations like payment card rules and privacy laws pushed companies to protect customer data. DLP expanded from email and network gateways to endpoints and, in the 2010s, to cloud services through cloud access security brokers. Microsoft built DLP into Microsoft 365 and its Purview suite. The rise of generative AI after 2022 created a new concern, after reports that Samsung engineers pasted confidential code into ChatGPT in 2023, prompting many organizations to apply DLP to AI tools. In my view, DLP works best when it guides people gently, not when it treats every employee as a suspect.