DLP

What it means

DLP, data loss prevention, is the set of tools and rules that stop sensitive data leaving a company uncontrolled. They track where documents and information go: in emails, uploads to the cloud, copies to USB sticks, printing or pasting into web apps, including AI tools.

A DLP tool recognises sensitive data by patterns, such as national ID numbers, IBANs or card numbers, by a document’s label or by its content. When it detects a risky transfer it can block it, warn the user, ask for a justification or simply log the incident for the security team.

DLP protects two kinds of value: personal data, whose leak is a personal data breach with a duty to notify, and the company’s know-how, meaning trade secrets, price lists, contracts or customer databases that could reach competitors.

How it works in practice

The prerequisite for DLP is information classification. Until a company knows which data are sensitive and where they are, there is nothing to protect. We advise smaller companies to start simply: label confidential documents, restrict external sharing in cloud storage and switch on basic rules in the email system.

Many office suites and cloud services include DLP features in the licence, such as a warning when a card number is emailed. On company devices managed through MDM, USB storage or copying into personal apps can be blocked. The rules should protect without getting in the way of normal work.

In an accounting firm the most sensitive items are payroll data, statements and clients’ ID documents. We send these only through secure channels with encryption, never as ordinary email attachments, and recommend the same to clients sending us documents.

What to watch out for

The most common mistake is settings so strict that they block legitimate work. People then look for workarounds, such as sending files through personal email or unapproved apps, and shadow IT appears, which is even riskier than before.

DLP cannot stop every leak. Someone can photograph data with a phone or copy it by hand. It must therefore go hand in hand with restricting access to those who really need the data, training and contractual confidentiality for staff and suppliers.