What is DLP?Data Loss Prevention explained

Sensitive data leaves an organization constantly, and almost all of it is legitimate: a contract emailed to a client, a file copied to a laptop before a trip. Data loss prevention watches that ordinary flow — outbound email, USB drives, cloud uploads, even the office printer — for the exceptions: a customer database exported right before someone resigns, source code pasted into a personal note-taking app, medical records sent to the wrong recipient by mistake.

It doesn't try to stop data from moving in general, since that would make the organization unusable. Instead it inspects what's actually inside a file or message as it tries to leave through a defined channel, and blocks or flags transfers that violate policy.

The problem it solves

Most sensitive-data exposure isn't a sophisticated attack; it's an ordinary action taken with the wrong file, recipient, or destination. A well-meaning employee drags a folder to a personal cloud account to work from home. A departing salesperson takes a client list they've come to think of as their own. Neither looks malicious in the moment, and neither trips an alarm without something specifically watching content rather than known attack patterns.

Left unmanaged, this kind of leakage is invisible until it's disclosed — often by a customer or regulator, not the organization itself. Inspecting data in motion catches it at the one moment it's still preventable.

How it works

The core capability is content inspection: rather than trusting a filename or folder location, the system reads what's actually inside a file or message and matches it against sensitive-data patterns — government ID formats, card numbers, source code signatures, custom keyword lists — often combined with machine classification for data that doesn't follow a rigid pattern.

That inspection runs at the specific points data tries to leave: the endpoint, where it governs USB drives, clipboard actions, and printing; the network and email gateway, where it scans outbound traffic; and increasingly cloud and SaaS applications, where files are shared and synced without touching a managed device. Policies often start from templates aligned to specific regulations, saving a team from writing detection logic for a well-known data type from scratch. A match can block the action, quarantine it for review, or simply log it and route the incident to a reviewer.

DLP vs DSPM

Data loss prevention watches data as it moves and enforces policy at the moment of transfer; it has no opinion about data that just sits still. Data security posture management does the opposite: it finds and maps sensitive data wherever it already lives — including copies nobody remembers creating — without touching anything in transit. A forgotten database export sitting in a misconfigured storage bucket, readable by far more people than intended, is invisible to a DLP system because nothing ever tried to move it; that's exactly the exposure the other category exists to surface. Mature programs run both.

Choosing one

Start with channel coverage: a policy that only watches email misses the laptop's USB port and every cloud app, and whoever is trying to get data out will use whichever path is left unwatched. Classification accuracy matters just as much — an overly aggressive system blocks legitimate work often enough that people route around it, while an overly loose one lets exactly the traffic it exists to catch through unnoticed.

Finally, weigh how much ongoing tuning a candidate needs. Templates get a policy running quickly, but every organization's data looks a little different, and the tools that stay effective are the ones a team can keep tuned as that data changes.