Data Loss Prevention (DLP): How It Works, Types and Limits

Sensitive data can leave an organization in ordinary ways: an email attachment, a file synced to a personal cloud account, a document copied to a USB drive. For agencies, law firms, hospitals and defense suppliers, each of those moments can expose case files, patient records or controlled technical data.

Data loss prevention (DLP) tools are built to notice those moments and stop the ones that break policy. This guide explains how DLP works, where it falls short and how it fits with access control.

What is data loss prevention (DLP)?

Data loss prevention (DLP) is a set of tools and policies that identify sensitive data, monitor how it is used and moved, and block or flag transfers that break policy. The NIST glossary, citing CNSSI 4009, describes DLP as a system's ability to identify, monitor and protect data in use, in motion and at rest.

DLP is also called data leakage prevention. In NIST SP 800-53 Rev. 5, the guidance for control SC-7(10), Prevent Exfiltration, compares exfiltration prevention to DLP and lists DLP tools among its techniques, for both intentional and unintentional exfiltration.

The three data states DLP covers

• Data in use: data being opened, edited, copied, pasted or printed on a device.
• Data in motion: data moving across a network, such as email, web uploads and file transfers.
• Data at rest: data stored on file servers, databases, laptops and cloud storage.

No single inspection point sees all three states, which is why many DLP programs combine more than one tool.

How DLP tools work

Most DLP tools follow the same basic loop: find sensitive content, decide which policy applies, then act.

Content inspection

DLP inspects files and messages for patterns such as Social Security numbers or payment card numbers, for keywords, and for fingerprints of specific documents. The NIST definition adds context: who sent the data, what it is, which channel it uses, when it moves and where it is going.

Classification and policies

Classification labels tell the DLP tool what a file is, so policies do not depend on pattern matching alone. A label applied by a person or a tool can be stored with the file, and the policy says which labels may go to which destinations. NIST SP 800-53 control AC-16 covers this idea: attaching security attributes to information in storage, in process and in transmission.

Actions

When content matches a policy, a DLP tool can log the event, warn the user and ask for a business reason, block the transfer, quarantine the file or message for review, encrypt it, or alert the security team. A common approach is to start in monitor-only mode and move to blocking once policies are tuned.

Types of DLP

• Endpoint DLP: a software agent on laptops, desktops and servers that watches data in use, such as copying to USB drives, printing and uploads. It can keep working when the device is off the corporate network.
• Network DLP: inspection at gateways, proxies and other exit points, watching data in motion across web, email and file transfer traffic.
• Cloud DLP: connects to cloud storage and software-as-a-service apps, usually through their APIs, to scan stored files and sharing settings. Cloud DLP is often part of a cloud access security broker (CASB).
• Email DLP: scans outgoing messages and attachments, and can block, quarantine or encrypt them.

Endpoint vs network vs cloud DLP

Limits of DLP

False positives

Pattern matching flags harmless data that looks sensitive, such as a nine-digit reference number in the same format as a Social Security number. Too many alerts bury real incidents, and strict blocking interrupts legitimate work, which pushes people toward workarounds. Tuning policies is ongoing work.

Encrypted traffic

Network DLP can only inspect what it can read. Most web traffic is encrypted with TLS, so network DLP usually depends on decrypting traffic at a proxy or gateway. Password-protected archives and messages sent through end-to-end encrypted apps pass network DLP without their content being inspected.

Data people are allowed to see

DLP watches channels, not intent. Someone with legitimate access can read a document and retype it, summarize it or photograph the screen, and content inspection will not see it. That is why DLP works alongside controls for insider threats, such as least privilege and audit logs.

How DLP fits with access control and classification

DLP is one of three layers that depend on each other:

1. Classification decides what data is sensitive. NIST SP 800-53 covers this under security categorization (RA-2).
2. Access control decides who can open it. Least privilege (AC-6) keeps that group as small as the work allows.
3. DLP and information flow control decide where it can go next. NIST control AC-4 enforces approved rules for how information flows within and between systems.

The fewer people who can open a file, the fewer people DLP has to watch.

Do you need data loss prevention?

If you handle regulated or classified information, you need a way to stop it leaving through unapproved channels, but not necessarily a dedicated DLP suite. NIST SP 800-53 describes the outcome rather than a product: it includes controls to enforce information flow (AC-4) and prevent exfiltration (SC-7(10)), and DLP tools are one way to meet them. A practical order is to classify data and tighten access first, then add DLP where the remaining risk sits.

Where DekkoCORE fits

DekkoCORE is not a DLP tool, but it limits what can leave to begin with. Files shared as View only are read in the browser with no download or print button, and access ends on the expiry date you set. Region protection lets Hubs open only from the countries you allow, and every view and download is recorded in the audit log.

Common questions

Frequently Asked Questions