Cybersecurity glossary
What is Data Loss Prevention (DLP)?
Learn what Data Loss Prevention (DLP) is, how policies detect and block sensitive data in motion or at rest, where DLP fails, and how to combine it with identity, encryption, and logging.
Definition
Data Loss Prevention (DLP) is a set of policies and controls that identify sensitive information in documents, messages, and channels, then monitor, alert, encrypt, or block its movement so confidential data is less likely to leave approved boundaries.
Why “the firewall will stop the spreadsheet” is a myth
Data leaves through mail, SaaS, USB, screenshots, and APIs that look like normal work. Data Loss Prevention (DLP) is the attempt to recognize sensitive content on those paths and apply a policy: log, encrypt, justify, or block.
It works when you know what “sensitive” means. It fails when everything is marked confidential or nothing is classified at all.
Where DLP sits on the path
At rest
Scan shares, laptops, and cloud buckets for unencrypted secrets and regulated records that should not live there.
In motion
Email, web upload, chat, and API gateways that see content before it leaves the tenant.
On the endpoint
USB, print, clipboard, and local archive creation that bypass the corporate proxy.
In SaaS
Sharing links, external collaborators, and sync clients that never hit the old perimeter.
A DLP policy that people can live with
Inventory real data types
Name the few classes that would actually hurt: credentials, payment data, health, source that is crown-jewel.
Pick channels that matter
Start where exfil already happened or is easiest—email and cloud share links beat a global clipboard ban.
Detect, then enforce
Monitor-only until false positives are understood. Blocking a finance close is an incident of your own.
Coach and exception
User justifications, time-boxed exceptions, and owner review beat silent denies.
Escalate the rare event
Bulk destination change, off-hours archive of customer tables, or canary-file movement goes to IR.
Why DLP misses—and how to compensate
| Gap | Example | Compensate with |
|---|---|---|
| Encryption and archives | Passworded ZIP of a CSV | Endpoint archive rules, anomaly on volume, identity risk |
| Unlabeled data | Customer list in a personal sheet | Discovery scans and classification at creation |
| Approved channel abuse | Insider emails themselves via allowed domain | UEBA, canaries, and access minimization |
| Shadow SaaS | Unmanaged file-share app | CASB/SSPM, DNS, and browser controls |
- Classify a short list of sensitive types with business owners; do not DLP “everything.”
- Instrument email, cloud sharing, and endpoint removable media before exotic channels.
- Run in monitor mode until precision is good enough for blocks.
- Protect DLP incident content; matches often contain the very secrets you are guarding.
- Feed high-severity DLP events to IR with user, destination, and sample metadata—not full payloads in Slack.
- Pair DLP with least privilege and secrets management so there is less to leak.
- Review exceptions quarterly; permanent bypasses become the real exfil path.
- Test policies with known documents, including canary files, during purple exercises.
The practical takeaway
DLP watches sensitive content as it sits and moves, then applies a policy you can explain to the business. Classify what matters, enforce where data actually leaves, and escalate the rare true exfil—without turning every false match into SOC noise.
Related security terms
Sensitive Data Exposure
The outcome DLP tries to reduce when data is mishandled or stolen.
Canary Token
Decoy objects that alert when attackers loot what looks like sensitive data.
Audit Log
Records of exports and policy violations DLP should feed.
Incident Response
Handles confirmed exfiltration or insider leakage cases.
Secrets Management
Stops credentials living in files DLP would otherwise chase forever.
Frequently asked questions
What is DLP in simple terms?
It is technology and policy that looks for sensitive content—customer records, secrets, health data—and warns or stops it from being emailed, uploaded, copied to USB, or posted in chat.
Does DLP stop all data theft?
No. Encrypted archives, screenshots, paper, and approved channels used by a malicious insider still leak. DLP raises cost and visibility; it is not a force field.
Where is DLP typically enforced?
Email and web gateways, endpoints (USB, print, clipboard), SaaS/cloud APIs, and sometimes in-browser isolation. Coverage is only as wide as the channels you actually instrument.
How does DLP recognize sensitive data?
Pattern matching (card numbers), exact-data fingerprints, labeled files, keywords, machine-learning classifiers, and document tags from information-protection tools.
Why do employees hate DLP?
False blocks on legitimate work, unexplained pop-ups, and policies written without business process owners. Tune with exceptions and education, or people will route around it.
Is DLP a privacy risk?
Inspection can expose personal content to administrators. Minimize who can read matches, log access to DLP incidents, and align with legal bases for monitoring.
How should DLP alerts be handled?
Most are coaching or policy events. A small subset (bulk export, unusual destination, executive data) should page IR. Dumping every match on the SOC recreates alert fatigue.
References
Explore authoritative guidance and frameworks related to data loss prevention (dlp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.