Skip to content
Knowledge Hub/Article
Article

What Is DLP (Data Loss Prevention)? How Does It Work?

DLP detects and stops sensitive data leaving the organization. We cover its role in data security, its types, how it works and its link to Turkish law.

Oğuzhan Gerçek··9 min read
What Is DLP (Data Loss Prevention)? How Does It Work?

Short answer: DLP (data loss prevention) is the set of technologies and policies that detect and prevent sensitive data from leaving an organization without authorization. It watches data in three states: at rest in storage, in motion across the network and in use on the endpoint. It recognizes content through patterns, document fingerprints or exact data matching; when an action matches a rule, it logs it, warns the user, blocks the action or encrypts the content. The "loss" in its name means leakage, not deletion, so DLP does not replace backup, and backup does not replace DLP.

What is DLP?

The definition in NIST's glossary describes DLP as a system's ability to identify, monitor and protect data in use (endpoint actions), data in motion (network actions) and data at rest (storage). It does so by inspecting content and analyzing the context of each transaction: who sent the data, through which medium, when and to whom. The aim is to detect and prevent the unauthorized use and transmission of data.

The name can mislead. NIST defines data loss as the exposure of proprietary, sensitive or classified information through either data theft or data leakage. What DLP prevents is not data being deleted but data ending up in the wrong hands. There is a short definition of the related concept in our glossary.

Data security and where DLP fits

In the 2.0 version of the NIST Cybersecurity Framework, published in February 2024, data security means managing data consistent with the organization's risk strategy to protect its confidentiality, integrity and availability. The definitions in NIST's glossary are:

  • Confidentiality: Preserving authorized restrictions on access to and disclosure of information.
  • Integrity: Guarding information against improper modification or destruction.
  • Availability: Ensuring timely and reliable access to information.

CSF 2.0 lists the protection of data at rest, in transit and in use as separate outcomes, and backups fall under the same category. DLP sits on the confidentiality side of this picture. Identity and access management (IAM) decides who can access what; DLP catches someone with legitimate access sending data to the wrong place. Verizon's 2026 Data Breach Investigations Report (DBIR) shows what is at stake: the human element was present in 62% of the more than 22,000 confirmed breaches it analyzed.

Types of DLP: network, endpoint, email and cloud

DLP can be grouped into four types, depending on where the data is caught:

  • Network DLP: Inspects data in motion in network traffic. Microsoft's network data security solution can inspect traffic coming from SASE products for uploads to unsanctioned cloud storage, form submissions and interactions with generative AI.
  • Endpoint DLP: Watches data in use on the device. Microsoft's Endpoint DLP can control copying to the clipboard, copying to a USB device or a network share, printing and uploading to a restricted cloud domain on Windows and macOS devices. The device's other protective layers are the subject of our endpoint security article; we cover the two together in our DLP & endpoint security service.
  • Email DLP: Inspects outgoing messages before they are sent. Google's Gmail DLP rules can block a message, warn the user, quarantine it for administrator review or only log the event; the contents of password-protected files, however, are not scanned. We cover the other layers of email security in our business email article.
  • Cloud and SaaS DLP: Looks at data stored and shared in the cloud. Purview DLP covers Exchange, SharePoint, OneDrive and Teams, while Google Workspace's data protection rules cover Drive, Gmail, Chat and Calendar.

According to NIST SP 800-215, a CASB (cloud access security broker) likewise sits between the organization and its cloud providers and offers DLP capabilities by monitoring the data flowing into and out of the providers' servers.

How does DLP work?

It works in three steps. The first is inventory and classification: CSF 2.0 calls for inventories of data and corresponding metadata for designated data types to be maintained. Sensitivity labels in Microsoft Purview can classify content and apply protections such as encryption and watermarks. Because the label is stored in metadata, it travels with the content, and DLP rules can use it as a condition.

The second step is recognizing content. Three methods stand out in Microsoft's documentation:

  • Patterns and regular expressions: Sensitive information types look for data such as credit card or bank account numbers using regular expressions, which can include checksum validation. Nearby keywords corroborate a match, and each result gets a high, medium or low confidence level.
  • Document fingerprinting: Fingerprinting creates a sensitive information type from a standard form. In Microsoft's example, the fingerprint of a blank patent template catches filled-in patent documents on their way out.
  • Exact data match (EDM): EDM looks for the actual values in a database rather than generic patterns; the table can hold up to 100 million rows. According to Microsoft, the result is fewer false positives.

The third step is action. In Purview, a rule can warn the user, block sharing either outright or with an override that requires a justification, and move data at rest to a secure quarantine location; in Exchange it can encrypt the message. All monitored activities are recorded in the audit log by default. We cover classification and channel-based policies in our data security & DLP service.

How do you roll out DLP?

Microsoft recommends deploying policies in simulation mode and evaluating their impact before running them in more restrictive modes; in simulation mode, the policy's actions are not applied. The goal is to meet the control objective without disrupting valid workflows. In Google Workspace, a rule can be created as inactive and reviewed with the team first, and Gmail's "audit only" action logs the event without stopping the message. In practice, the sequence can look like this:

  1. Build the inventory and start with a few critical data types.
  2. Run the rule in a log-only mode; review the matches with business units and narrow the conditions that produce false positives.
  3. Turn on warnings with justified overrides first, then blocking for clear-cut cases.

Insider risk and shadow AI

NIST defines insider threat as the threat that an insider will use their authorized access, wittingly or unwittingly, to do harm. The "unwittingly" part is DLP's core territory: an employee who sends a file to the wrong recipient or uploads it to a personal account may not be malicious, but the data still leaves. Access control will not stop them, because their access is legitimate.

Generative AI is a fast-growing channel. According to the 2026 DBIR, 67% of users access AI services with non-corporate accounts on their corporate devices, and the share of employees who are regular AI users on corporate devices rose from 15% to 45% in a year. In the report's DLP dataset, unauthorized AI use ("shadow AI") became the third most common non-malicious insider action in 2025. Source code was the type of data most often submitted to external AI models.

DLP vs backup

Both are part of data protection, but they address different risks. DLP protects confidentiality, preventing data from reaching unauthorized people. Backup's job is availability: it brings back data that was deleted, corrupted or encrypted. We cover backup types in our backup article.

Ransomware shows the difference best. According to NIST's IR 8374 Rev. 1, published in June 2026, attackers encrypt data and demand payment to restore access; they may also steal the information and demand an additional payment for not disclosing it. A backup restores the encrypted data, but it cannot recall the stolen copy. We cover the stages of such an attack in our ransomware article.

DLP and Turkish data protection law

Under Article 12 of the KVKK (Türkiye's personal data protection law), the data controller must take all necessary technical and administrative measures to ensure an appropriate level of security, in order to prevent the unlawful processing of and unlawful access to personal data and to ensure its retention (consolidated text on Lexpera, in Turkish). The article does not name any specific technology; DLP is one of the tools that can be used on the technical side of these measures. Under the same article, if processed personal data is obtained by others through unlawful means, the data controller notifies the data subject and the Personal Data Protection Board as soon as possible. DLP logs help define the scope of that notification by showing which data left, when and through which channel.

We explain notification readiness in our 72-hour article and cover compliance in our KVKK / GDPR service. There is a short definition of the law in our glossary.

Frequently asked questions

What does DLP mean? It stands for data loss prevention: the technologies and policies that prevent sensitive data from leaving an organization without authorization.

What is data security? It is the protection of the confidentiality, integrity and availability of data. DLP focuses on the confidentiality side.

How does DLP work? It recognizes content through patterns, fingerprints or exact data matching, then logs, warns, blocks or encrypts according to the rule.

What is endpoint DLP? A type of DLP that monitors and restricts actions on a computer, such as copying to the clipboard or a USB drive, printing and uploading to the cloud.

What is the difference between DLP and backup? DLP prevents data from leaking out; backup brings back data that was deleted or encrypted. Neither replaces the other.

Sources