Data Loss Prevention Definition
Data loss prevention (DLP) is a set of tools and processes that stops sensitive data from being lost, misused, or shared with people who shouldn't have it. DLP finds sensitive information, such as customer records, health data, payment card numbers, and intellectual property. It then monitors how that information is used and moved, and enforces policies that allow, block, encrypt, or flag each action.
DLP protects data in three states. Data at rest sits in storage. Data in motion travels across networks, email, and the web. Data in use is being opened, edited, or copied on a device. It covers accidental leaks, like an employee emailing a file to the wrong person, and deliberate theft by insiders or attackers. The term is also written as data leakage prevention, and both mean the same thing.
How does data loss prevention work?
DLP works in three steps. First, discovery and classification finds sensitive data across endpoints, file shares, cloud storage, and email, and labels it by sensitivity. Second, monitoring tracks how that data is accessed and where it moves, such as email attachments, web uploads, USB transfers, printing, and copy-paste. Third, policy enforcement compares each action against rules the organization defines, often based on regulations like HIPAA, PCI DSS, or GDPR. When an action breaks a policy, DLP can block it, encrypt the data, warn the user, or alert the security team. Accurate classification is what keeps DLP effective. Without it, policies either miss real leaks or flood teams with false alerts.
What are the different types of DLP?
There are three main types of DLP, and most organizations use them together. Endpoint DLP runs as an agent on laptops, desktops, and servers. It controls actions like USB transfers, printing, screenshots, and uploads to personal apps, and it keeps protecting data when users are off the corporate network. Network DLP inspects traffic leaving the organization, including email, web uploads, and file transfers, and can block sensitive data before it goes out. Its weakness is that it only sees traffic passing through the network points it monitors. Cloud DLP finds and protects sensitive data in SaaS apps, cloud storage, and collaboration tools, and stops risky external sharing. Many vendors also list email DLP as its own type.
How do you implement a DLP program?
A successful DLP program starts with strategy before tools. Begin by defining your objective, whether that's regulatory compliance, protecting intellectual property, or gaining visibility into how data moves. Next, identify your most valuable data: what sensitive data you hold, where it lives, and who uses it. Bring in stakeholders from legal, compliance, HR, and the business early, since DLP policies affect how people work. Then roll out in phases. Start in monitor-only mode to learn normal data flows, then turn on blocking for the highest-risk scenarios, then expand. Solutions like Fortra DLP support this approach with context-based classification and coverage across endpoints, networks, and the cloud.