What is data loss prevention in cybersecurity?
Data loss prevention (DLP) is a set of security policies and tools that find sensitive information, such as card numbers, health records or client files, and stop it from leaving the business by email, cloud sharing, chat or USB drive. Each policy defines what counts as sensitive and what happens on a match: warn, block or log.
Data Loss Prevention (DLP) is a category of security controls that identify sensitive information, such as Social Security numbers, credit card data, or patient records, and stop it from being sent or copied somewhere it should not go. A DLP system inspects content as it moves and applies a policy: allow, warn the user, encrypt, block, or record the event for review.
DLP works by classifying data first. Rules look for patterns (a nine-digit number formatted like a Social Security number), keywords (a project codename), or labels a user applied to a document. Cloud platforms such as Microsoft 365 include DLP as part of Microsoft Purview, where a single policy can cover Exchange email, SharePoint, OneDrive, Teams chat, and Windows and Mac endpoints, depending on the license. When a policy matches, the system can stop an email to an outside address, prevent a file from being uploaded to a personal cloud account, or block a copy to a USB drive, and it can show the employee a message explaining why.
In a small or mid-sized business most data loss is accidental rather than malicious: a spreadsheet of client records attached to the wrong email, a contract synced to a personal Dropbox, a departing employee forwarding files to a home account. DLP catches these events and creates a record, which matters for firms subject to HIPAA, the FTC Safeguards Rule, or state privacy laws that require reasonable safeguards and proof they were in place. Tuning is the hard part. Policies that are too strict block legitimate work and get switched off.
NetSys deploys and tunes DLP as a managed service, using the policies already licensed in a client's Microsoft 365 tenant wherever possible. The work starts with an inventory of where sensitive data lives, then moves to policies in audit mode so real traffic can be reviewed before anything is blocked. NetSys's data loss prevention service page describes the process, and Latoya Reed, who covers cloud and Microsoft 365 for NetSys, writes about the configuration choices involved.
Why it matters for a small business
If your business holds anyone else's personal or financial information, you are responsible for where it goes. A single misdirected email with a client list can trigger breach notification duties and a regulator's questions. DLP is the control that catches the mistake before it leaves the building, and it produces the evidence auditors and insurers now ask for. For many companies the tooling is already paid for inside Microsoft 365; what is missing is someone to configure it carefully so it protects data without stopping people from doing their jobs.
Data Loss Prevention (DLP): FAQs
What is data loss prevention in simple terms?
Data loss prevention is software that watches for sensitive information, such as card numbers or medical records, and stops it from being emailed or uploaded to places it should not go. It works from policies that define what counts as sensitive and what should happen when it is detected: warn the user or block the action, and log the event. Most modern DLP lives inside cloud platforms like Microsoft 365 rather than as a separate appliance.
What is a data loss prevention policy?
A DLP policy is the rule set that tells the system what to protect, where and how. In Microsoft Purview each policy names the locations it watches, such as Exchange email, SharePoint, OneDrive, Teams or devices, the conditions that count as a match, such as a type of sensitive information or a sensitivity label, and the action to take: show the user a policy tip, block with an override and a recorded reason, block outright, or audit. Microsoft recommends running a new policy in simulation mode first and tuning it before it blocks anything.
Does Microsoft 365 include DLP?
Yes, through Microsoft Purview, but the plan decides how much. As of October 2026, Microsoft's Purview service description lists Microsoft 365 Business Premium, E3 and E5, and Office 365 E3 and E5, as including DLP for Exchange email, SharePoint and OneDrive. DLP for Teams chats and for Windows and Mac devices needs Microsoft 365 E5 or a Purview add-on, and Business Basic and Business Standard include none of it. Useful policies still have to be designed for your data and tested in simulation mode before they block anything.
Do small businesses need data loss prevention?
Any business that handles customer personal data, payment information, or health records benefits from it, and several regulations effectively require it. HIPAA, the FTC Safeguards Rule, and New York's SHIELD Act all expect reasonable technical safeguards against unauthorized disclosure. Beyond compliance, DLP prevents the most common breach in a small firm, which is an honest mistake by an employee. Starting with a few high-value policies in monitoring mode is a practical first step.
More terms
Discuss data loss prevention (dlp) for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.