Data Loss Prevention (DLP).

Data Loss Prevention (DLP) is a control category that inspects content in motion, at rest, and in use, then enforces policies to keep regulated or confidential data inside trusted boundaries. DLP engines combine pattern matching, lexical rules, exact data matching, machine learning, and document fingerprinting to recognize PII, payment data, source code, or intellectual property. Typical enforcement actions include blocking an outbound email, quarantining a file, requiring justification, or redacting content before it leaves the environment. Mature deployments link DLP to data classification, IAM, and SIEM/SOAR so that incidents are triaged, evidence is preserved, and policies are tuned to cut false positives while supporting GDPR, HIPAA, and PCI DSS obligations.

Channels, detection, and the insider problem

DLP is usually deployed across three enforcement points: endpoint agents (blocking USB copy, print, clipboard and screenshot), network/email gateways (inspecting SMTP, web uploads and cloud sync), and cloud/API connectors that scan data at rest in SaaS and object storage. Detection quality hinges on identifying the right content: regex alone flags too much, so serious programs layer exact data matching (hashing rows of a real customer database), document fingerprinting for proprietary files, and dictionaries for regulated terms. PCI DSS Requirement 4 and GDPR Article 32 are common drivers, but the most valuable rule is often the least clever — alert when a single user exports thousands of records at once.

The hardest cases are insiders and endpoint egress rather than mass hacks. In 2022 Yahoo sued departing research scientist Qian Sang, alleging he downloaded roughly 570,000 files of the company's AdLearn intellectual property to personal devices minutes after receiving a competitor's job offer — exactly the "in-use" exfiltration DLP is meant to catch. Because motivated insiders can photograph a screen or use encrypted channels, DLP works best as one layer of a broader program: least-privilege access, user-activity monitoring (UEBA), and encryption, tuned continuously to keep false positives from training staff to ignore alerts.

flowchart TD
  D[Sensitive data<br/>PII / PCI / source code] --> C{DLP inspection}
  C -->|Endpoint| E[USB / print / clipboard]
  C -->|Network / email| N[SMTP / web upload]
  C -->|Cloud / API| S[SaaS / object storage]
  E --> P{Policy match?}
  N --> P
  S --> P
  P -->|Yes| B[Block / quarantine / redact<br/>+ alert to SIEM]
  P -->|No| A[Allow]