Home / Knowledge hub / Data loss prevention
Knowledge hub
Data loss prevention
Tools and rules that stop sensitive data leaving where it should stay.
What it means
Data loss prevention, usually shortened to DLP, is a set of tools and rules that find sensitive data and stop it moving where it should not. It might block an email carrying card numbers, flag a customer export copied to a personal drive, or stop a file being shared outside the company.
DLP works on content and context. It looks for patterns such as card numbers or ID formats, for labels you have applied, and for who is sending what to where. It is a guardrail around people and systems you already trust, not a lock on the application itself.
Why it matters
Most leaks are not dramatic. An employee mails a spreadsheet to the wrong address, a developer pastes production data into a public tool, a backup bucket is left open. DLP catches some of these before the data is gone, and leaves a record when it cannot.
It also helps with proof. Regulations such as GDPR and HIPAA expect you to protect personal data, and a DLP policy with logs is something concrete to show an auditor. It needs data classification first, or it has nothing to match against.
How it shows up
You meet DLP in email gateways, endpoint agents, cloud storage and browser controls. It is tuned with rules: block, warn, or log. Too strict and staff work around it. Too loose and it only produces noise, which feeds alert fatigue.
Know what it cannot see. It does not read your application's logic. If a signed-in account can pull another customer's records through an API, that traffic is a normal, allowed request, and DLP has no reason to stop it. Encrypted traffic and screenshots are also common gaps.
Questions people ask
Data loss prevention, answered
Is DLP the same as a firewall?
No. A firewall decides which network traffic may pass. DLP looks at what the data is and who is moving it.
They sit side by side. A firewall can allow a connection that DLP then blocks because the content is sensitive.
Does DLP stop a data breach?
It can stop some leaks, mainly those caused by people and misconfigured sharing. It does not stop an attacker using a flaw in your application to read data through normal requests.
Treat it as one layer, not the whole defence.
What does DLP need to work well?
It needs to know what counts as sensitive. That means classified data, clear policies and someone who reviews the alerts.
Without those it blocks the wrong things and misses the right ones.
Can DLP read encrypted traffic?
Only if it sits where the traffic is decrypted, such as on the endpoint or at a gateway that inspects it. Otherwise encrypted content passes through unseen.
This is a normal limit, so check where your product inspects.
Do small companies need DLP?
Not always as a separate product. Many email and cloud suites include basic DLP rules.
Start with knowing where your sensitive data lives and who can reach it. Tools come second.
Sources
Where this comes from
Related
Terms that sit next to this one
Data classification
Labelling data by how sensitive it is so each kind gets the right protection.
Data exfiltration
Quietly copying data out of your systems to somewhere the attacker controls.
Data masking
Hiding part of a value, such as card digits, so most people only see a safe version.
Insider threat
Harm from someone with legitimate access, through malice or by mistake.
CASB
A control point between your staff and the cloud apps they use.
What can a normal request still read?
DLP cannot see an application that hands over data to an account that should not have it. We check that gap and prove it with the request, the response and the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.