Data Loss Prevention (DLP)

Overview

Data Loss Prevention (DLP) is a set of policies and technical controls used to discover, classify, monitor, restrict, and investigate sensitive data while it is stored, used, or transmitted. The control exists to protect personal and sensitive data while enabling lawful access, analysis, security, and business use under defined rights and governance. It differs from backup because DLP aims to prevent unauthorized disclosure or movement rather than restore lost information. It should be interpreted alongside Data Security Posture Management (DSPM) because the concepts can affect the same decision without representing the same control, event, or risk.

The workflow identifies data, purpose, legal basis, owner, location, recipients, retention, access, and risk before applying minimization, protection, monitoring, response, and deletion controls. Decisions should consider individual rights, security needs, contractual duties, and the risk of revealing another person’s data. In this context, programs should define data classes, authorized flows, inspection points, encryption, endpoint and cloud coverage, exception handling, privacy limits, alert triage, user coaching, evidence retention, and measures of prevented and false-positive events.

It should connect the term to Cloud Access Security Broker (CASB) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Records should preserve data inventories, classifications, requests, identity checks, searches, disclosures, redactions, approvals, access events, incidents, exceptions, retention actions, and the rationale for decisions. Evidence itself should be minimized and protected.

Useful measures include sensitive-data coverage, unauthorized disclosures, request completion time, overdue requests, false-positive alerts, excessive access, retention exceptions, incident impact, and verified deletion or remediation.

The relationship with Audit Log should be documented where it affects residual risk or control ownership.