Data Loss Prevention (DLP)

Overview

Meaning and scope

Data Loss Prevention (DLP) is a set of policies and technical controls used to discover, classify, monitor, restrict, and investigate sensitive data while it is stored, used, or transmitted. It differs from backup because DLP aims to prevent unauthorized disclosure or movement rather than restore lost information.

Mechanism and operation

The control exists to protect personal and sensitive data while enabling lawful access, analysis, security, and business use under defined rights and governance. Decisions should consider individual rights, security needs, contractual duties, and the risk of revealing another person’s data. In this context, programs should define data classes, authorized flows, inspection points, encryption, endpoint and cloud coverage, exception handling, privacy limits, alert triage, user coaching, evidence retention, and measures of prevented and false-positive events. It should connect the term to Cloud Access Security Broker (CASB) where that relationship changes access, transaction treatment, investigation, communication, or recovery.

Practical payment example

A company configures DLP rules to stop accidental exports of customer records and wallet backups. Security tests whether alerts catch sensitive files without obstructing legitimate finance reporting.

Operational checks

Records should preserve data inventories, classifications, requests, identity checks, searches, disclosures, redactions, approvals, access events, incidents, exceptions, retention actions, and the rationale for decisions. Useful measures include sensitive-data coverage, unauthorized disclosures, request completion time, overdue requests, false-positive alerts, excessive access, retention exceptions, incident impact, and verified deletion or remediation.

Distinctions and limits

The workflow identifies data, purpose, legal basis, owner, location, recipients, retention, access, and risk before applying minimization, protection, monitoring, response, and deletion controls. The relationship with Audit Log should be documented where it affects residual risk or control ownership.

Related reading

Related definitions: Data Security Posture Management (DSPM), Cloud Access Security Broker (CASB).