Data security is the part of enterprise cybersecurity that guards the data itself, wherever it is kept, instead of guarding a place such as the inbox or the network. It also covers privacy: the duties that a company has towards the people whose personal data it holds.
It starts from an uncomfortable fact. Most companies do not know where all their sensitive data is. Imagine a housing finance company in Nagpur with 1,500 employees. Its customers' PAN numbers, salary slips and bank statements are in the loan system. But copies also sit in spreadsheets on employees' laptops, in a test database that developers use, and in files attached to old emails. This zone has four jobs, with products for each.
The first job is to find the data. Data security posture management (DSPM) searches every system, labels the sensitive data it finds, and checks who can open it. Its part data access governance maps which employees can open which folders.
The second job is to stop the data from leaving. Data loss prevention (DLP) checks email, USB drives, uploads and chat, and blocks data that must not go out. Its part insider risk management watches for an employee who is leaving and taking data along. Enterprise digital rights management protects a file even after it has been sent outside.
The third job is to make the data safe to use, because the business must keep using it. Data protection does this in three ways: it encrypts the data, swaps real values for tokens, or masks part of each value.
The fourth job is the privacy programme. Privacy management records each customer's consent, handles requests to see or delete personal data, and keeps a map of where personal data is stored and sent. Its part AI governance checks AI systems against the same rules.
Data protection law turned all of this from a good habit into a legal duty. In India, the Digital Personal Data Protection (DPDP) Act of 2023 and the DPDP Rules of 2025 set these duties. Most of these duties apply from 13 May 2027. The GDPR does the same in the EU. Data security also meets two neighbouring zones. Uploads to cloud apps are watched by the cloud access security broker in network security. And what staff paste into outside AI tools is controlled by shadow AI control.