Data loss prevention (DLP) is software that checks every way data can leave a company, such as email, USB drives, uploads and chat, and blocks the data that must not leave. It is also called data leak prevention. DLP watches the exits. It does not guard the places where data is stored.
DLP works by rules that the security team writes. To apply a rule, DLP must first recognise sensitive data. It does this in three main ways. It matches patterns: a PAN number, for instance, is five letters, four digits and one letter, such as ABCDE1234F. It matches fingerprints, which are records of exact documents that the company has marked as secret. And it reads labels that other tools have attached to a file, such as "Confidential". These labels are often set by data security posture management (DSPM).
Consider a stock-broking firm in Kolkata. An employee in the back-office team wants to finish some work at home over the weekend. On Friday evening, she attaches a spreadsheet to an email addressed to her personal email account. The spreadsheet holds 6,200 clients' names, PAN numbers and holdings. A DLP rule says that no file with more than 50 PAN numbers may be sent outside the company. The rule matches, and the email is held back. She sees a message that explains why, and offers her a way to ask her manager for an exception. The event is also sent to the SIEM, the security team's central store of logs.
She meant no harm, and most DLP events are like this. So many rules start in a softer mode. A new rule first only records events. Later it warns the employee. It blocks only when the security team trusts that it will not stop genuine work.
The rules are checked at several points. An agent on each laptop watches copies to USB drives, printing and uploads. The secure email gateway checks outgoing email. The secure web gateway and the cloud access security broker (CASB) check uploads to websites and cloud apps. A growing exit is the AI chatbot, because staff paste client data into outside AI tools. That exit is covered by shadow AI control.
Pattern rules miss data that has been changed, such as a customer list that has been renamed and locked in a zip file. So newer tools follow each piece of data from where it was created. That is the method of insider risk management. DLP also differs from enterprise digital rights management. DLP decides whether a file may leave. Rights management protects the file after it has left.
Indian law raises the stakes. Under the Digital Personal Data Protection Act, a company must protect personal data with reasonable security safeguards. It must also report every personal data breach to the Data Protection Board of India and to each person affected. A company that fails to protect the data can be fined up to ₹250 crore, and one that fails to report a breach can be fined up to ₹200 crore. Most of the Act's duties, including these two, apply from 13 May 2027.