Glossary
DLP (data loss prevention)
Also called: Data loss prevention
In one sentence
Tools and policies that spot sensitive information — like Social Security numbers or patient records — and stop it from being shared where it shouldn’t go.
Data loss prevention looks at the content of emails, documents and messages and recognizes sensitive patterns: credit card numbers, Social Security numbers, bank details or health information. When it finds them, a policy decides what happens — warn the user, require encryption, block the message, or alert an administrator.
In Microsoft 365, DLP is part of Microsoft Purview. Business Premium includes DLP policies for Exchange email, SharePoint and OneDrive, with built-in templates for things like U.S. financial data and health information. Rules can start in “tip” mode, where staff see a gentle warning, and tighten once you understand normal patterns.
Why it matters for a small office: most data leaks aren’t sophisticated hacks. They’re a staff member emailing a spreadsheet of patient data to the wrong “Jennifer,” attaching a client’s tax return to an unencrypted email, or saving files to a personal account. DLP catches those mistakes at the moment they happen.
Example: an accounting firm turns on a DLP policy that detects Social Security numbers. If someone tries to email a document containing several SSNs outside the firm without encryption, Outlook shows a policy tip and the message is blocked until it’s sent encrypted. Read HIPAA-compliant email encryption and our Microsoft 365 plan comparison to see which plans include what.
Related terms
- Encryption in transitProtecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
- Microsoft 365 Business PremiumMicrosoft 365 Business Premium is Microsoft's top small-business plan (up to 300 users), combining Office apps, email and Teams with device management and advanced security.
- PHI (protected health information)PHI is any health information that can be linked to a specific person and is created or held by a healthcare provider, health plan or their vendors.
- Least privilegeLeast privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
- FTC Safeguards RuleA Federal Trade Commission rule requiring non-bank financial businesses — including tax preparers and many accounting firms — to run a written information security program.