What Is Data Loss Prevention (DLP)?
Data Loss Prevention (DLP) detects and blocks sensitive data from leaving an organization improperly — the personal information, financial records, and intellectual property that must not walk out the door. It inspects data in use, in motion, and at rest, and acts when protected data heads somewhere it should not. Useful against everyday leaks, it is also a control with honest limits worth understanding.
How does DLP work?#
DLP identifies sensitive data (by patterns, fingerprints, or classification) and watches the channels it could leave through:
| Data state | Example control |
|---|---|
| In use | Block copying to USB or clipboard |
| In motion | Inspect email/web uploads for protected data |
| At rest | Find sensitive files stored where they shouldn’t be |
When a policy triggers, DLP can block the action, alert, or log it — with the appropriate response depending on how disruptive a false positive would be.
Where DLP helps, and where it doesn’t#
DLP is genuinely effective against accidental leaks and casual misuse: the employee who emails a spreadsheet of customer data to the wrong address, or uploads it to a personal cloud. It is far weaker against a determined insider or attacker, who can encrypt, obfuscate, or use channels DLP does not cover. It also generates false positives that must be tuned.
DLP is one layer of protecting sensitive data. More at the Defense & Hardening hub.
Frequently asked questions#
What is data loss prevention?
Data Loss Prevention (DLP) is a set of tools and processes that detect and prevent sensitive data — like personal information, financial records, or intellectual property — from leaving an organization improperly. DLP inspects data in use, in motion, and at rest, and can block, alert on, or log attempts to move protected data to unauthorized destinations.
What are the limits of DLP?
DLP struggles with encrypted or obfuscated data it cannot inspect, generates false positives that frustrate users, and can be bypassed by determined insiders through channels it does not cover. It works best against accidental leaks and casual misuse; it is not a reliable barrier against a skilled, motivated attacker set on exfiltration.