Need indicators
This capability is usually relevant when these signals appear in the operating environment.
Sensitive files are sent externally.
Data is copied to unauthorized media.
Limited visibility into data movement.
Back to solutions
Discuss your use case
Data and Information Protection
Technology solutionData Loss Prevention
Find sensitive data, monitor its movement across supported channels, and block or alert based on policy and context.
What is this solution?
DLP ties sensitive-data identification to a decision when data is used or transferred. It can recognize a content pattern or label and evaluate channel, destination, and user context. Visibility and enforcement differ across mail, web, and endpoints, so design policy around channels the deployment can observe.
Data loss prevention enforces policy on supported paths. Test sensitive file transfer controls using email and USB DLP policies.
Practical example
An employee tries to move a customer-data file to an unapproved channel. The pilot starts in monitoring mode, and the team enables an action after reviewing legitimate cases.
Technical summary and scope of use
Technical explanation
Data Prevention (DLP) is a specialized security system used to detect, monitor and control sensitive data within the workplace environment, and attempts to get it out via multiple channels.
The technology relies on a standard agent on the end user’s devices that performs multiple functions including: identifying data sources, detection of sensitive data, data classification, control of transmission media, and monitoring different leakage channels.
The goal is to reduce the risk of sensitive data loss, control data transfers, and give security teams better visibility and audit evidence.
The Data Prevention Technology (DLP) helps protect sensitive information within the staff’s devices by knowing where the data is located, monitoring how it is used and preventing the output in unauthorized ways.
When you try to print a file, copy it to external storage media, or send it by mail, messaging apps or cloud services, the technology scans content; and if it contains sensitive data, it can stop the process, record it or add cookies to it.
This helps organizations to reduce the chances of data leak, improve the control of information traffic, and enhance compliance and data governance within the work environment.
Scope of use
The technology is used to protect personal and confidentiality data, reduce information leakings, monitor data exports, support privacy and compliance requirements, and provide inspection records of activities related to data output.
The technology works in end-user device environments, supports various operating systems, supports internal, cloud and managed hosting.
What it delivers
Core capabilities that turn the requirement into practical controls.
Centralized administration
Sensitive data discovery
Data loss prevention
Expected value
The impact security teams and leadership can expect from the right implementation.
Reduced data leakage
Clearer policy enforcement
Faster data incident response
Technical capabilities
Feature availability depends on product version, target systems, deployment, and integrations.
Centralized administration
A central management unit through a web interface.
Access records from the supported work interface; test search, permissions, and activity review per channel.
A standard view of sensitive data within a central system.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Possibility of standard management with other solutions and technologies.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Support search in records using a quick search engine.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Support long-term research in records.
Record what happened, when, and in which scope; review event fields and retention for investigation and audit.
Advanced research filter support.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Sensitive data discovery
Supports more than 100 pre-known patterns.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Data patterns are covered by data protection laws in more than 60 countries.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Automatically update the patterns when the Privacy Policy changes.
Map settings and evidence to organizational policy; applicability and effectiveness must still be assessed.
Reduce the need for manual management.
Compare representative workflows before and after rollout to measure manual effort and processing time.
Support the verification of sensitive data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Support regional and international data patterns.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Support the creation of custom data patterns within the organization.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Data loss prevention
Control the data leakage through printing, storage media, and network.
Define permitted media and how data may be transferred to it, recording approved exceptions.
Block unauthorized transfers of personal or confidential data
A DLP policy ties data sensitivity to the destination so a transfer of personal or confidential data can be blocked on an unauthorized path.
Add watermark to sensitive outputs.
Add a visible mark to covered output for attribution and deterrence; a mark is not a transfer block.
Prohibit copying and attaching of sensitive data.
Test pasting sensitive content into an unapproved application and compare with an allowed workflow.
Block copying of sensitive files according to policy
Test copying a sensitive file to an unapproved destination and compare with an authorized copy to verify scope.
Control of data leakage via mail, correspondence and cloud services.
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Record the date of export of data, files and texts.
Record the time and identifier of in-scope exports so they can be linked to alerts or later review.
Keep an original copy for auditing purposes.
Keep records retrievable under retention and access rules; test preservation and disposal.
Removable media and device control
Control of external storage media.
Define permitted media and how data may be transferred to it, recording approved exceptions.
Control of external hard drives.
Define which transfer channels fall under policy and test blocking and approved exceptions.
Control of wireless communication technologies.
Define which transfer channels fall under policy and test blocking and approved exceptions.
Control the methods of file sharing on different operating systems.
Restrict sharing paths and recipients according to work policy and test unauthorized access.
Implement the definition of data assets and media control through one agent.
Define permitted media and how data may be transferred to it, recording approved exceptions.
Support of operating systems
Support different office operating systems.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Control of data leakage within the end user device environments.
Associate users or groups with authorized scope and review how membership changes affect access.
Common management of security policies through instruments.
Bring configuration and monitoring into one management point while keeping operator permissions restricted.
Operations and deployment
support of internal publication.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
support for cloud publishing.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Support for public cloud and private cloud.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Support the Managed Hosting Model.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Provide periodic reports within hosting models.
Present reviewable results to compare changes and identify cases requiring action.
Self-driving support in internal publishing environments.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
Technical support
training sessions.
Set support scope, expected action, and escalation according to the agreed service terms.
Assistance in preparation and preparation.
Configure behavior for the use case and retain the approved configuration for review or rollback.
Explore the errors.
Set support scope, expected action, and escalation according to the agreed service terms.
Maintenance at request.
Set support scope, expected action, and escalation according to the agreed service terms.
Support from specialized technical support teams.
Set support scope, expected action, and escalation according to the agreed service terms.
Compliance and Privacy
Support the requirements for personal data protection.
Map settings and evidence to organizational policy; applicability and effectiveness must still be assessed.
Support data protection control implementation
Test the scenario that triggers protection and a similar legitimate case to tune false positives.
Support the self-classing of data.
Assign information to a category that determines how it is handled so safeguards reflect sensitivity.
Support for self-discovery of data.
Identify data that may need protection using supported matching criteria; test accuracy on representative examples.
Support the secure data destruction.
Map settings and evidence to organizational policy; applicability and effectiveness must still be assessed.
Support for data encryption.
Limit data readability without the required keys; confirm where encryption starts and ends.
Reduce the operational burden on work teams.
Confirm environment requirements, supported versions, and dependencies before moving the configuration to production.
How the technology works
Discovery
Detects sensitive data with predefined and custom patterns. Validation checks help reduce reliance on manual review.
Control
The technology applies policies that control data output channels such as printing, storage media and network, with the possibility of blocking or adding cookies to sensitive data.
Monitoring
The technology follows processes of printing, copying files, copy and attachment, mailing, correspondence, and cloud services.
Inspection
The technology records data output processes and keeps reference copies for the purposes of audit and subsequent investigation.
Centralized administration
The technology provides a standard platform for managing policies, records and sensitive data from a central point.
Reduce operating burden.
Supports automated classification and discovery, disposal, and encryption to reduce manual work.
Support of user devices
The technology provides storage and communication controls within the end user devices within a standard management.
What to validate before rollout
- Define content patterns or classification labels that the channel can read.
- Decide when to monitor, alert, or restrict on supported channels.
- Distinguish legitimate activity from attempted leakage before expanding enforcement.
Integration and scope
Define the data, channels, and devices in scope. Test content detection and the operational effects of alerting or blocking.
Challenges this solution addresses
- Personal or confidential data is leaked through the printing.
- The data flow through external storage media.
- Data leakage via mail, correspondence or cloud services.
- A lack of central vision of sensitive data.
- Difficulty searching in long-term records.
- The need to manage data patterns manually.
- Weak control of the end user devices.
- Difficulty in tracking data output processes.
- The subsequent audit of the activities.
- Multiple control tools on devices.
- Weak support for privacy and compliance requirements.
- Weak control of copying, attaching or copying sensitive files.
- The need for custom data patterns.
- High operating burden on the work teams.
Regulatory alignment
Illustrative ways to support control implementation. An area may have more than one example; each row is not necessarily a separate official control.
NCA · ECC 2:2024For entities within the scope of the Essential Cybersecurity Controls.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Support the identification of data assets on user devices | Applied |
| Protection of systems and processing facilities | Control of external storage media and reduce the risk of data output | Applied |
| mobile device security. | Control of End User Devices and Transport Media | Applied |
| Protection of data and information | Prevent the leak of sensitive data through printing, storage media and network | Applied |
| Cryptography | Support data encryption within operating processes | Applied |
| Events records and monitoring | Registration of data exports and keeping records | Applied |
| Incident and threat management | Providing accurate data to help analyze incidents | Applied |
| Cloud computing and hosting | Support for cloud publishing and managed hosting | Applied |
SAMA · CSFFor financial institutions within the Saudi Central Bank framework, subject to the control's applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Support the identification of data assets within the end user devices to help make a clearer view of sensitive data sites Related capability: Definition of the data source | Applied |
| Protection of Sensitive Data | Discover and control personal and confidential data through different channels Related capability: Discover sensitive data and prevent data leakage | Applied |
| Classification of data | Support the user’s self-classing of data to help handle data according to its sensitivity Related capability: Self Classification of Data | Applied |
| Data loss prevention | Block or limit the output of sensitive data through printing, storage and network Related capability: Control of printing, storage media and network | Applied |
| Events and records. | Registration of data export processes such as printing, issued files and text messages Related capability: Data Export Registry | Applied |
| Security Monitoring | Providing a centralized visibility of sensitive data and output-related activities through a central management unit Related capability: Central Management Unit | Applied |
| compliance and audit | Keeping the asset and output records for use as subsequent verification data Settings or logs can help prepare evidence. Governance decisions and effectiveness testing remain with the organization. Related capability: Conservation of the asset for auditing purposes | Applied |
| Protecting the systems | Implementing data leak control and media control through a standard agent on user devices Related capability: Unified Agent on User Devices | Applied |
| Protection of Infrastructure | Support for external storage media control and transfer technologies on end-user devices Related capability: Control of external media. | Applied |
| Operational Security | Reduce the need to managing patterns manually through predefined patterns and updates related to changes in privacy systems Related capability: Pre-knowledge patterns | Applied |
| Long-term records management | Supporting long-term records search using a fast search engine and advanced filters Related capability: Search Engine in Records | Applied |
| Security of cloud environments | Support Cloud Publishing and Managed Hosting Models with periodic reports Related capability: Cloud Publishing and Hosting Managed | Applied |
| Incident response | Providing data and inspection records that can be used to analyze data leakings after they occur Related capability: Registration and retention of the origin. | Applied |
| Protection of sensitive financial systems | Supporting the protection of personal and confidential data and preventing unauthorized disclosure within financial sector environments Related capability: Preventing sensitive data leakage. | Applied |
NCA · OTCC-1:2022For operational technology and industrial control environments to which the controls apply.
Evaluate these examples against the facility level and assets in scope. They do not authorize IT/OT connectivity or component installation on operational assets without assessment.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Management of assets | Support the definition of data sources within devices | Applied |
| mobile device security. | Controls for user devices and transfer media Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. | Applied |
| Protection of data and information | Use data leakage mechanisms to protect sensitive data | Applied |
| Protection of data during use or transfer | Control of printing, copying and sending files through the network | Applied |
| records and monitoring. | Registration of data output and keeping records | Applied |
| Incident and threat management | Provide audit data to investigate leakage events. | Applied |
| Incident response | Support investigations through records and reference data Verify asset compatibility and test operational impact before deploying an agent or taking response action in an OT environment. | Applied |
Aramco · SACS-210 (2026)For Aramco third parties, subject to their classification and assessment scope. These examples do not establish CCC certification.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| DLP policy and monitoring of sensitive data exfiltration | DLP can monitor or restrict sensitive transfers on network paths covered by policy. This does not establish coverage for channels outside inspection scope. | Applied |
NCA · DCC-1:2022For entities within the scope of the Data Cybersecurity Controls, subject to data classification and control applicability.
| Domain or control | How it supports implementation | Application |
|---|---|---|
| Data loss prevention and rights management | DLP can detect classified data and monitor or restrict its transfer on covered channels for Confidential, Secret, and Top Secret data under the control matrix. Verify rights management separately where it is not part of the solution. | Applied |
“Applied” describes the capability in the illustrative example, not an implementation or compliance status for the customer.
Decision questions
Questions before you start
How do we know this solution is right for us?
Start with the risk signals on this page. If they match your environment, they can be turned into a short assessment that defines scope, priority, and a practical implementation approach.
How do we start without adding operational complexity?
Start with a focused risk and scope assessment, then define implementation priorities, technical requirements, and phased rollout steps.
Related solutions
Email Security
Email Security Gateway
Reduce phishing, malicious attachments, and risky links before they reach users.
Explore solutionClassification
Data Classification
Identify the sensitivity of files, email, and data so protection follows information value.
Explore solutionWatermarking
Screen and File Watermarking
Add visible marks that link content to a user or session to reduce informal leakage.
Explore solutionReady for the next step?
Turn this need into a practical assessment and clear implementation plan.
Share your use case and priority systems so we can discuss a pilot and its integration requirements.