Data Loss Prevention

DLP helps control what happens to sensitive information

Data Loss Prevention is a combination of policies, business rules, information classification, employee education, monitoring, technical controls, investigation and governance. It does not operate as a single blocking rule. It is a governed set of responses designed around information, context and risk.

Depending on licensing and architecture, DLP may monitor or control information across Exchange and email, SharePoint, OneDrive, Microsoft Teams, Office applications, managed Windows devices, web browsers, cloud applications, on-premises repositories and removable storage.

When sensitive information is identified and a user attempts an action, the policy evaluates the context and responds accordingly:

Data loss is often caused by convenience, complexity and unclear rules

Understanding how data loss occurs is essential before designing controls. The causes are rarely limited to malicious actors. Most incidents involve employees making reasonable decisions without sufficient guidance or clear information structures.

Security must follow the data beyond the network boundary

Traditional security controls focus on preventing unauthorised access. They protect identities, secure devices, block malware and monitor external threats. DLP adds a complementary layer of controls around what an authorised user or application may do with information after access has been granted.

AI makes existing data-governance weaknesses easier to exploit

Organisations are increasingly introducing Microsoft Copilot, AI assistants, AI agents, automated reporting, workflow automation, connected applications, business intelligence, knowledge assistants, customer portals and automated document processing. Each of these technologies raises the same fundamental question: which information should the technology be permitted to access, and what should it be allowed to do with it?

An employee may previously have needed to search through several SharePoint sites to locate information they should not routinely access. An AI assistant can potentially surface that information through a natural-language question if the existing permissions allow it. The AI did not create the access problem. It made the consequences of that problem easier to experience.

IT can configure the policies. It cannot decide what every department's information means.

DLP is a business project, not an IT configuration. The technology can identify and control sensitive information, but the business must decide what its important data is, where it should live and how employees are permitted to use it.

Consider a category called"customer information". It may include public contact details, commercial discussions, bank details, contracts, service records, complaints, health or personal information and sales opportunities. Different controls may be appropriate for each. Only the business can make those distinctions.

Data governance should also form part of the organisation's wider technology roadmap. The IT Strategy Supporting Your Business Strategy guide explores how to align technology decisions with commercial goals.

Do not begin by creating blocking policies

Before any DLP policy is designed, the organisation should understand what important information it holds, where it is stored, who owns it, who can access it, who needs access, how it is shared, which applications use it, how long it should be retained, and the impact of disclosure or unavailability.

DLP often exposes problems in the existing Microsoft 365 structure

Before DLP policies are deployed, the existing SharePoint, Teams and OneDrive environment should be reviewed. Common weaknesses include duplicate SharePoint sites, multiple Teams spaces for the same purpose, unclear ownership, excessive internal access, historic external guests, confidential data in general collaboration areas, project sites retained indefinitely, departmental information stored in personal OneDrive, files copied into several locations and inconsistent folder naming.

Departments must help identify the information they understand best

Wavex can provide a structured departmental template or workshop process. For each important folder, library, repository or data set, the department should be asked a consistent set of questions. Departments should not be given unrestricted responsibility to invent classifications. The organisation should define a small, consistent classification model first, and departments should work within it.

When assessing new applications and platforms, it is also worth reviewing how they handle company data. The guide on Why Software Selection Fails and How to Get It Right covers the questions to ask about unapproved applications and shadow IT.

A classification model must be simple enough for employees to use

The following four levels are illustrative. The final labels and terminology should reflect the organisation's needs, culture and regulatory context. The key principle is consistency: a model that employees can understand and apply reliably is more valuable than a complex taxonomy that is inconsistently used.

A label should lead to a clear and proportionate control

Once the classification model is agreed, the organisation should define what each label means in practice. The policy should distinguish between routine legitimate activity, unusual but justifiable activity, high-risk activity and prohibited activity.

Start by observing, not blocking

A policy that blocks legitimate work will encourage employees to search for another route. The recommended approach is to introduce controls gradually, beginning with audit or simulation mode to understand real-world activity before any restrictions are applied.

DLP should guide employees, not simply surprise them

The objective is not to stop employees using information. It is to allow people and technology to use it productively without losing control over where it goes. Employee communication is therefore a critical part of any DLP programme.

A DLP alert has no value unless somebody owns the response

The governance structure around DLP is as important as the technical configuration. The organisation should define who reviews alerts, which alerts are urgent, how business context is obtained, when security, HR, legal or compliance becomes involved, how false positives are recorded, how policy changes are approved, how repeated exceptions are escalated and how leadership receives reporting.

The goal is not necessarily zero DLP events. Some legitimate business processes require sensitive information to be used and shared. The objective is visibility and appropriate control.

How Wavex Helps Organisations Deliver Data Loss Prevention

Wavex helps clients connect the technical controls with the business decisions, information ownership and employee processes required for DLP to work effectively. DLP is a project Wavex can help clients plan, implement and operate, providing technology, security and governance support throughout.