Data Loss Prevention (DLP)

DLP works by recognising sensitive content and watching where it goes. Recognition relies on patterns such as card or national ID numbers, keywords, document labels, or fingerprints of known files. Monitoring happens at several points: on laptops (copying to USB, printing, uploading), on the network and in email, and in cloud services. When a policy is triggered, the system can allow the action but log it, warn the user, require a business reason, or block it. Rules need tuning, since too many false alarms teach people to ignore them, and encrypted traffic can limit what the tools see. DLP is a detective and preventive control that depends on good data classification, because it must know what counts as sensitive. It supports privacy and confidentiality duties and is common in banks, healthcare and technology firms. Expect it to catch careless sends and bulk copying more reliably than a determined insider who photographs a screen.

An employee at a health insurer tries to email a spreadsheet of 3,000 member records to a personal address. The DLP tool spots the pattern of ID numbers, blocks the message and alerts the security team. The employee explains that she wanted to work from home, and is shown the approved remote access route.