Data loss prevention
Data loss prevention (DLP) uses policies to identify sensitive information and monitor or restrict how it is shared, transferred, or used.
What happens when a policy matches?
DLP connects a description of sensitive information with rules for handling it. A policy might apply to financial records sent outside the organization, or protected files uploaded to certain websites. Depending on the product and configuration, the result may be an audit event, a warning, an overridable restriction, or a block.
Those outcomes matter. A record of an upload does not mean the upload was stopped. A warning that someone can override is a different control from a block they cannot bypass through that workflow.
Microsoft Purview illustrates this distinction: its policies support different actions for different locations, and simulation mode lets administrators evaluate matches without enforcing the configured protective actions.
Coverage is part of the policy
A DLP deployment does not automatically inspect every way information can leave. Check the data classification, users, devices, applications, and transfer methods that the policy actually covers. In Microsoft’s endpoint implementation, for example, both the user and device must be in scope, and supported activities vary by platform.
An online file converter is a useful case to think through: the sensitive document leaves when it is uploaded, before anyone opens the converted download. An eDiscovery export raises a different question: who approved the collection and its destination? DLP can contribute a technical restriction, but it does not establish that the underlying business request is legitimate.