Data loss prevention watches for sensitive information leaving through mail, the web, or removable devices and can block it.
It is a control against unwanted departure of data, not a complete privacy program and not proof that insiders are trustworthy.
How it works
Rules look for defined kinds of content, destinations, or channels, then warn, record, or stop the transfer.
Too many broad rules create noise that staff learn to ignore, while too few rules miss the files that actually matter.
The control can be bypassed by determined misuse or by data that does not match the patterns you listed, so it belongs beside access limits and training.
People need a legitimate way to send approved material or they will invent unsafe paths.
Concrete examples
- Outbound mail containing a large customer extract is held for review before it leaves the company domain.
- A laptop warns when someone tries to copy a marked design folder onto a personal removable drive.
- A web upload of source code to a personal storage site is blocked and shown to the file owner.
Protective measures
- Start with a short list of data types that must not leave, and name an owner who can approve exceptions.
- Provide a sanctioned path for legitimate external sharing so staff are not pushed toward hidden channels.
- Tune rules that produce constant false warnings, because ignored warnings stop protecting anything.
- Review blocked events for real incidents, and do not collect more content than the investigation needs.