What is data loss prevention (DLP)?
Data loss prevention (DLP) is the combination of software and policy that watches for sensitive data leaving the places it is allowed to be. DLP tools inspect email, file uploads, chat messages, and network traffic for card numbers, Social Security numbers, patient identifiers, and documents labeled confidential through data classification. On a match, the tool can block the transfer, strip the sensitive content, warn the user, or log the event for review.
DLP guards against both mistakes and intent. Most incidents it catches involve someone attaching the wrong spreadsheet, but the same rules stop deliberate data exfiltration.
Why DLP matters
Generative AI created a new exit for data. Staff paste customer lists, contracts, and source code into public chat tools for help with their work, and the content leaves the company in a form no email filter sees. This is much of what shadow AI means in practice. DLP vendors now cover browser sessions and the API traffic through an AI gateway, where a policy can redact PII from a prompt before it leaves or block one that contains a restricted document.
A regional insurance broker finds that producers use a public chatbot to rewrite policy summaries containing client names and premiums. Rather than ban the practice, the broker deploys a private model for the task and configures DLP to block public tools for anyone handling client data. Usage moves to the sanctioned system, and the DLP logs show what was being pasted before, which guides the next round of classification.