What is DLP?

Data Loss Prevention (DLP) is a set of security tools and processes that detect and prevent the unauthorized transfer, exposure, or destruction of sensitive data, such as personal information, financial records, or intellectual property. DLP systems inspect data in motion, in use, and at rest, then enforce policy through actions like alerting, blocking, or quarantining a match.

Key takeaways

• DLP detects and blocks unauthorized transfer of sensitive data.
• Policies combine data patterns, boolean logic, and enforcement actions.
• Coverage spans data in motion, at rest, and inside cloud apps.
• Actions range from silent alerting to hard blocking and rejection.
• Inspecting encrypted SaaS traffic requires TLS decryption first.

On this page: Why it matters · How it works · Types · DLP & Versa · FAQ

Why is DLP important?

Sensitive data now leaves an organization through dozens of everyday channels – an email attachment, a SaaS upload to Dropbox or SharePoint, a Slack message, a USB drive, a misconfigured cloud bucket. Most of these transfers are not malicious; an employee attaches the wrong file, or copies a customer list into a personal account to work from home. A smaller number are deliberate exfiltration. DLP matters because it catches both cases at the point of transfer, before the data leaves the organization’s control, rather than after a breach is already underway.

Regulatory pressure raises the stakes further. Frameworks such as GDPR, HIPAA, and PCI DSS require organizations to demonstrate that personally identifiable information, health records, and payment card data are actively protected, not just access-controlled. DLP gives compliance teams an enforceable, auditable control: every match, alert, and block is logged, producing the evidence regulators and auditors ask for. As work moves off-network and data moves to the cloud, DLP is one of the few controls that follows the data itself rather than a fixed network perimeter.

What is DLP?

DLP works by classifying content and then applying policy at the point sensitive data would leave its authorized boundary. Classification methods range from simple pattern matching – regular expressions and keyword dictionaries that recognize things like credit card numbers or national ID formats – to more precise techniques: exact data matching against a known dataset, document fingerprinting against a registered template, and optical character recognition for text embedded in images.

A detection alone does nothing without an enforcement point. DLP systems sit inline at those points – web and email gateways, cloud access brokers, endpoint agents – where they inspect traffic or files in the relevant context (an upload, a download, an attachment, a clipboard paste) and take a policy-defined action: allow it, log an alert, block the transfer outright, or terminate the session. Because encrypted traffic hides its payload by design, DLP for web and SaaS traffic typically depends on TLS decryption to see the content it needs to inspect.

Types of DLP

DLP is commonly grouped by where enforcement happens. Network DLP inspects data in motion at network or cloud egress points – web gateways, email, and SASE/SSE inspection points – and is the most common deployment because it covers many users and applications from one enforcement layer. Endpoint DLP runs as an agent on laptops and desktops, controlling local actions a network-layer control can’t see, such as USB copies, clipboard operations, and printing, and keeps working when a device is off the corporate network. Cloud DLP integrates with a cloud access security broker to inspect data at rest inside SaaS applications and cloud storage, not just in transit. Discovery (data-at-rest) DLP scans file shares, databases, and repositories to find where sensitive data already lives, which is often the first step before writing effective transfer policies. Most mature deployments combine several of these rather than relying on one.

DLP & Versa

Versa delivers DLP as one of the core Security Service Edge services in VersaONE, configured in Concerto under Security Service Edge > Real-Time Protection. The configuration model is modular and layered: Data Patterns define the granular regex-and-keyword detection for a value like a credit card or ID number; Data Protection Profiles combine multiple patterns with boolean and proximity operators (AND, OR, NOT, NEAR) to express more precise conditions; DLP Rules consume one or more profiles and choose an inspection method – Content Analysis, File DLP, Exact Data Match (EDM), Document Fingerprinting, or OCR – scoped to specific file types, activity (upload/download), and context (header, body, attachment); and DLP Profiles aggregate multiple rules and apply them to specific applications and user groups. A DLP profile is then attached to a SASE Internet Protection rule or a private application protection rule, with actions of Allow, Alert, Block, or Reject.

Because most DLP-relevant traffic to SaaS apps like Gmail, Slack, or SharePoint is encrypted, a TLS decryption rule for the target applications is a prerequisite for content inspection. Versa also ships built-in DLP rules – including a GenAI_DLP profile bundling Source_Code, US_Financial, and PII_US detection – and every DLP event is logged to Versa Analytics for review. See the DLP Configuration Guide for worked use cases and Configure Data Loss Prevention in Concerto for the full configuration reference.

Frequently asked questions

What is the difference between DLP and a firewall?

A firewall (or NGFW) controls which connections and applications are allowed based on identity, port, and application signatures. DLP inspects the actual content of allowed traffic for sensitive data patterns. They’re complementary: a firewall decides what traffic is permitted, and DLP decides what content within that traffic can leave.

What is Exact Data Match (EDM) in DLP?

EDM compares outbound content against a hashed, structured dataset – such as a customer database – rather than a generic pattern. It matches specific records (a real customer ID, not just something that looks like one), which sharply reduces false positives compared to regex-only detection.

What is Document Fingerprinting in DLP?

Document fingerprinting registers a sensitive form or template and computes a similarity score between it and files in transit. If an outbound file’s content overlaps the template above a configured threshold, the rule triggers – useful for protecting structured forms whose exact wording varies each time.

Does DLP require TLS decryption?

For web and SaaS traffic, yes. DLP inspects payload content, and encrypted connections hide that payload by design. A TLS decryption rule for the relevant applications has to exist before a DLP rule can see inside an upload, attachment, or message body.

What’s the difference between network DLP and endpoint DLP?

Network DLP inspects data in motion at gateways and cloud inspection points, covering many users from one enforcement layer but only traffic that crosses the network. Endpoint DLP runs on the device itself, so it also catches local actions like USB transfers, even when the device is offline.

More on DLP

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DLP, these are worth looking at next.