Data loss prevention (DLP) is a set of tools and policies that identify sensitive data and stop it from being used or sent where it should not go. DLP covers data in use on endpoints, data in motion over networks and email, and data at rest in storage.

How it works

• Classification: content is labeled or detected by patterns, such as card numbers, national ID numbers, keywords or document fingerprints.
• Policy: rules state what may happen to each class of data, for example “customer records may not be uploaded to personal cloud storage”.
• Enforcement: the system alerts, encrypts, quarantines or blocks the action, and logs it for review.
• Context: decisions take into account the sender, recipient, device, channel and time.

DLP works best for data an organization knows and can describe. Overly strict policies cause many false positives and push users toward shadow IT.

Why it matters for dark web monitoring

DLP tries to keep data inside; dark web monitoring checks whether it got out anyway. Leaks often bypass DLP entirely, for example through a compromised supplier, a misconfigured server or an infostealer that copies browser data. When leaked company documents or databases appear on criminal sites, the finding shows where DLP coverage was missing and helps rate the damage of a data breach.

Sources: NIST CSRC Glossary: data loss prevention